4 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
8 sudoers - list of which users may execute what
10 D
\bDE
\bES
\bSC
\bCR
\bRI
\bIP
\bPT
\bTI
\bIO
\bON
\bN
11 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is composed of two types of entries:
12 aliases (basically variables) and user specifications
13 (which specify who may run what).
15 When multiple entries match for a user, they are applied
16 in order. Where there are multiple matches, the last
17 match is used (which is not necessarily the most specific
20 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs grammar will be described below in Extended
21 Backus-Naur Form (EBNF). Don't despair if you don't know
22 what EBNF is; it is fairly simple, and the definitions
25 Q
\bQu
\bui
\bic
\bck
\bk g
\bgu
\bui
\bid
\bde
\be t
\bto
\bo E
\bEB
\bBN
\bNF
\bF
27 EBNF is a concise and exact way of describing the grammar
28 of a language. Each EBNF definition is made up of _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\b
29 _
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be_
\bs. E.g.,
31 symbol ::= definition | alternate1 | alternate2 ...
33 Each _
\bp_
\br_
\bo_
\bd_
\bu_
\bc_
\bt_
\bi_
\bo_
\bn _
\br_
\bu_
\bl_
\be references others and thus makes up a
34 grammar for the language. EBNF also contains the follow
35 ing operators, which many readers will recognize from reg
36 ular expressions. Do not, however, confuse them with
37 "wildcard" characters, which have different meanings.
39 ? Means that the preceding symbol (or group of symbols)
40 is optional. That is, it may appear once or not at
43 * Means that the preceding symbol (or group of symbols)
44 may appear zero or more times.
46 + Means that the preceding symbol (or group of symbols)
47 may appear one or more times.
49 Parentheses may be used to group symbols together. For
50 clarity, we will use single quotes ('') to designate what
51 is a verbatim character string (as opposed to a symbol
54 A
\bAl
\bli
\bia
\bas
\bse
\bes
\bs
56 There are four kinds of aliases: User_Alias, Runas_Alias,
57 Host_Alias and Cmnd_Alias.
64 1.6.9p12 January 14, 2008 1
70 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
73 Alias ::= 'User_Alias' User_Alias (':' User_Alias)* |
74 'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
75 'Host_Alias' Host_Alias (':' Host_Alias)* |
76 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)*
78 User_Alias ::= NAME '=' User_List
80 Runas_Alias ::= NAME '=' Runas_List
82 Host_Alias ::= NAME '=' Host_List
84 Cmnd_Alias ::= NAME '=' Cmnd_List
86 NAME ::= [A-Z]([A-Z][0-9]_)*
88 Each _
\ba_
\bl_
\bi_
\ba_
\bs definition is of the form
90 Alias_Type NAME = item1, item2, ...
92 where _
\bA_
\bl_
\bi_
\ba_
\bs_
\b__
\bT_
\by_
\bp_
\be is one of User_Alias, Runas_Alias,
93 Host_Alias, or Cmnd_Alias. A NAME is a string of upper
94 case letters, numbers, and underscore characters ('_'). A
95 NAME m
\bmu
\bus
\bst
\bt start with an uppercase letter. It is possible
96 to put several alias definitions of the same type on a
97 single line, joined by a colon (':'). E.g.,
99 Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
101 The definitions of what constitutes a valid _
\ba_
\bl_
\bi_
\ba_
\bs member
107 User ::= '!'* username |
112 A User_List is made up of one or more usernames, system
113 groups (prefixed with '%'), netgroups (prefixed with '+')
114 and other aliases. Each list item may be prefixed with
115 one or more '!' operators. An odd number of '!' operators
116 negate the value of the item; an even number just cancel
119 Runas_List ::= Runas_User |
120 Runas_User ',' Runas_List
122 Runas_User ::= '!'* username |
130 1.6.9p12 January 14, 2008 2
136 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
139 A Runas_List is similar to a User_List except that it can
140 also contain uids (prefixed with '#') and instead of
141 User_Aliases it can contain Runas_Aliases. Note that
142 usernames and groups are matched as strings. In other
143 words, two users (groups) with the same uid (gid) are con
144 sidered to be distinct. If you wish to match all user
145 names with the same uid (e.g. root and toor), you can use
146 a uid instead (#0 in the example given).
151 Host ::= '!'* hostname |
153 '!'* network(/netmask)? |
157 A Host_List is made up of one or more hostnames, IP
158 addresses, network numbers, netgroups (prefixed with '+')
159 and other aliases. Again, the value of an item may be
160 negated with the '!' operator. If you do not specify a
161 netmask along with the network number, s
\bsu
\bud
\bdo
\bo will query
162 each of the local host's network interfaces and, if the
163 network number corresponds to one of the hosts's network
164 interfaces, the corresponding netmask will be used. The
165 netmask may be specified either in standard IP address
166 notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
167 CIDR notation (number of bits, e.g. 24 or 64). A hostname
168 may include shell-style wildcards (see the Wildcards sec
169 tion below), but unless the hostname command on your
170 machine returns the fully qualified hostname, you'll need
171 to use the _
\bf_
\bq_
\bd_
\bn option for wildcards to be useful.
176 commandname ::= filename |
180 Cmnd ::= '!'* commandname |
185 A Cmnd_List is a list of one or more commandnames, direc
186 tories, and other aliases. A commandname is a fully qual
187 ified filename which may include shell-style wildcards
188 (see the Wildcards section below). A simple filename
189 allows the user to run the command with any arguments
190 he/she wishes. However, you may also specify command line
191 arguments (including wildcards). Alternately, you can
192 specify "" to indicate that the command may only be run
196 1.6.9p12 January 14, 2008 3
202 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
205 w
\bwi
\bit
\bth
\bho
\bou
\but
\bt command line arguments. A directory is a fully
206 qualified pathname ending in a '/'. When you specify a
207 directory in a Cmnd_List, the user will be able to run any
208 file within that directory (but not in any subdirectories
211 If a Cmnd has associated command line arguments, then the
212 arguments in the Cmnd must match exactly those given by
213 the user on the command line (or match the wildcards if
214 there are any). Note that the following characters must
215 be escaped with a '\' if they are used in command argu
216 ments: ',', ':', '=', '\'. The special command "sudoedit"
217 is used to permit a user to run s
\bsu
\bud
\bdo
\bo with the -
\b-e
\be flag (or
218 as s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt). It may take command line arguments just as
219 a normal command does.
221 D
\bDe
\bef
\bfa
\bau
\bul
\blt
\bts
\bs
223 Certain configuration options may be changed from their
224 default values at runtime via one or more Default_Entry
225 lines. These may affect all users on any host, all users
226 on a specific host, a specific user, or commands being run
229 Default_Type ::= 'Defaults' |
230 'Defaults' '@' Host_List |
231 'Defaults' ':' User_List |
232 'Defaults' '>' Runas_List
234 Default_Entry ::= Default_Type Parameter_List
236 Parameter_List ::= Parameter |
237 Parameter ',' Parameter_List
239 Parameter ::= Parameter '=' Value |
240 Parameter '+=' Value |
241 Parameter '-=' Value |
244 Parameters may be f
\bfl
\bla
\bag
\bgs
\bs, i
\bin
\bnt
\bte
\beg
\bge
\ber
\br values, s
\bst
\btr
\bri
\bin
\bng
\bgs
\bs, or
245 l
\bli
\bis
\bst
\bts
\bs. Flags are implicitly boolean and can be turned off
246 via the '!' operator. Some integer, string and list
247 parameters may also be used in a boolean context to dis
248 able them. Values may be enclosed in double quotes (")
249 when they contain multiple words. Special characters may
250 be escaped with a backslash (\).
252 Lists have two additional assignment operators, += and -=.
253 These operators are used to add to and delete from a list
254 respectively. It is not an error to use the -= operator
255 to remove an element that does not exist in a list.
257 See "SUDOERS OPTIONS" for a list of supported Defaults
262 1.6.9p12 January 14, 2008 4
268 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
271 U
\bUs
\bse
\ber
\br S
\bSp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn
273 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
274 (':' Host_List '=' Cmnd_Spec_List)*
276 Cmnd_Spec_List ::= Cmnd_Spec |
277 Cmnd_Spec ',' Cmnd_Spec_List
279 Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
281 Runas_Spec ::= '(' Runas_List ')'
283 Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
284 'SETENV:' | 'NOSETENV:')
286 A u
\bus
\bse
\ber
\br s
\bsp
\bpe
\bec
\bci
\bif
\bfi
\bic
\bca
\bat
\bti
\bio
\bon
\bn determines which commands a user may
287 run (and as what user) on specified hosts. By default,
288 commands are run as r
\bro
\boo
\bot
\bt, but this can be changed on a
291 Let's break that down into its constituent parts:
293 R
\bRu
\bun
\bna
\bas
\bs_
\b_S
\bSp
\bpe
\bec
\bc
295 A Runas_Spec is simply a Runas_List (as defined above)
296 enclosed in a set of parentheses. If you do not specify a
297 Runas_Spec in the user specification, a default Runas_Spec
298 of r
\bro
\boo
\bot
\bt will be used. A Runas_Spec sets the default for
299 commands that follow it. What this means is that for the
302 dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
304 The user d
\bdg
\bgb
\bb may run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm
305 -- but only as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br. E.g.,
307 $ sudo -u operator /bin/ls.
309 It is also possible to override a Runas_Spec later on in
310 an entry. If we modify the entry like so:
312 dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
314 Then user d
\bdg
\bgb
\bb is now allowed to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs as o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br,
315 but _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as r
\bro
\boo
\bot
\bt.
317 T
\bTa
\bag
\bg_
\b_S
\bSp
\bpe
\bec
\bc
319 A command may have zero or more tags associated with it.
320 There are six possible tag values, NOPASSWD, PASSWD,
321 NOEXEC, EXEC, SETENV and NOSETENV. Once a tag is set on a
322 Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the
323 tag unless it is overridden by the opposite tag (i.e.:
324 PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
328 1.6.9p12 January 14, 2008 5
334 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
337 _
\bN_
\bO_
\bP_
\bA_
\bS_
\bS_
\bW_
\bD _
\ba_
\bn_
\bd _
\bP_
\bA_
\bS_
\bS_
\bW_
\bD
339 By default, s
\bsu
\bud
\bdo
\bo requires that a user authenticate him or
340 herself before running a command. This behavior can be
341 modified via the NOPASSWD tag. Like a Runas_Spec, the
342 NOPASSWD tag sets a default for the commands that follow
343 it in the Cmnd_Spec_List. Conversely, the PASSWD tag can
344 be used to reverse things. For example:
346 ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
348 would allow the user r
\bra
\bay
\by to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl, _
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bs, and
349 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\bp_
\br_
\bm as root on the machine rushmore as r
\bro
\boo
\bot
\bt
350 without authenticating himself. If we only want r
\bra
\bay
\by to be
351 able to run _
\b/_
\bb_
\bi_
\bn_
\b/_
\bk_
\bi_
\bl_
\bl without a password the entry would
354 ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
356 Note, however, that the PASSWD tag has no effect on users
357 who are in the group specified by the _
\be_
\bx_
\be_
\bm_
\bp_
\bt_
\b__
\bg_
\br_
\bo_
\bu_
\bp option.
359 By default, if the NOPASSWD tag is applied to any of the
360 entries for a user on the current host, he or she will be
361 able to run sudo -l without a password. Additionally, a
362 user may only run sudo -v without a password if the
363 NOPASSWD tag is present for all a user's entries that per
364 tain to the current host. This behavior may be overridden
365 via the verifypw and listpw options.
367 _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC
369 If s
\bsu
\bud
\bdo
\bo has been compiled with _
\bn_
\bo_
\be_
\bx_
\be_
\bc support and the
370 underlying operating system supports it, the NOEXEC tag
371 can be used to prevent a dynamically-linked executable
372 from running further commands itself.
374 In the following example, user a
\baa
\bar
\bro
\bon
\bn may run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be
375 and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi but shell escapes will be disabled.
377 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
379 See the "PREVENTING SHELL ESCAPES" section below for more
380 details on how NOEXEC works and whether or not it will
383 _
\bS_
\bE_
\bT_
\bE_
\bN_
\bV _
\ba_
\bn_
\bd _
\bN_
\bO_
\bS_
\bE_
\bT_
\bE_
\bN_
\bV
385 These tags override the value of the _
\bs_
\be_
\bt_
\be_
\bn_
\bv option on a
386 per-command basis. Note that if SETENV has been set for a
387 command, any environment variables set on the command line
388 way are not subject to the restrictions imposed by
389 _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk, _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only trusted
390 users should be allowed to set variables in this manner.
394 1.6.9p12 January 14, 2008 6
400 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
403 If the command matched is A
\bAL
\bLL
\bL, the SETENV tag is implied
404 for that command; this default may be overridden by use of
407 W
\bWi
\bil
\bld
\bdc
\bca
\bar
\brd
\bds
\bs
409 s
\bsu
\bud
\bdo
\bo allows shell-style _
\bw_
\bi_
\bl_
\bd_
\bc_
\ba_
\br_
\bd_
\bs (aka meta or glob char
410 acters) to be used in pathnames as well as command line
411 arguments in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. Wildcard matching is done
412 via the P
\bPO
\bOS
\bSI
\bIX
\bX _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3) routine. Note that these are _
\bn_
\bo_
\bt
415 * Matches any set of zero or more characters.
417 ? Matches any single character.
419 [...] Matches any character in the specified range.
421 [!...] Matches any character n
\bno
\bot
\bt in the specified range.
423 \x For any character "x", evaluates to "x". This is
424 used to escape special characters such as: "*",
427 Note that a forward slash ('/') will n
\bno
\bot
\bt be matched by
428 wildcards used in the pathname. When matching the command
429 line arguments, however, a slash d
\bdo
\boe
\bes
\bs get matched by wild
430 cards. This is to make a path like:
434 match _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bw_
\bh_
\bo but not _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bX_
\b1_
\b1_
\b/_
\bx_
\bt_
\be_
\br_
\bm.
436 E
\bEx
\bxc
\bce
\bep
\bpt
\bti
\bio
\bon
\bns
\bs t
\bto
\bo w
\bwi
\bil
\bld
\bdc
\bca
\bar
\brd
\bd r
\bru
\bul
\ble
\bes
\bs
438 The following exceptions apply to the above rules:
440 "" If the empty string "" is the only command line
441 argument in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entry it means that com
442 mand is not allowed to be run with a
\ban
\bny
\by arguments.
444 O
\bOt
\bth
\bhe
\ber
\br s
\bsp
\bpe
\bec
\bci
\bia
\bal
\bl c
\bch
\bha
\bar
\bra
\bac
\bct
\bte
\ber
\brs
\bs a
\ban
\bnd
\bd r
\bre
\bes
\bse
\ber
\brv
\bve
\bed
\bd w
\bwo
\bor
\brd
\bds
\bs
446 The pound sign ('#') is used to indicate a comment (unless
447 it is part of a #include directive or unless it occurs in
448 the context of a user name and is followed by one or more
449 digits, in which case it is treated as a uid). Both the
450 comment character and any text after it, up to the end of
451 the line, are ignored.
453 The reserved word A
\bAL
\bLL
\bL is a built-in _
\ba_
\bl_
\bi_
\ba_
\bs that always
454 causes a match to succeed. It can be used wherever one
455 might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
456 or Host_Alias. You should not try to define your own
460 1.6.9p12 January 14, 2008 7
466 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
469 _
\ba_
\bl_
\bi_
\ba_
\bs called A
\bAL
\bLL
\bL as the built-in alias will be used in
470 preference to your own. Please note that using A
\bAL
\bLL
\bL can be
471 dangerous since in a command context, it allows the user
472 to run a
\ban
\bny
\by command on the system.
474 An exclamation point ('!') can be used as a logical _
\bn_
\bo_
\bt
475 operator both in an _
\ba_
\bl_
\bi_
\ba_
\bs and in front of a Cmnd. This
476 allows one to exclude certain values. Note, however, that
477 using a ! in conjunction with the built-in ALL alias to
478 allow a user to run "all but a few" commands rarely works
479 as intended (see SECURITY NOTES below).
481 Long lines can be continued with a backslash ('\') as the
482 last character on the line.
484 Whitespace between elements in a list as well as special
485 syntactic characters in a _
\bU_
\bs_
\be_
\br _
\bS_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn ('=', ':',
486 '(', ')') is optional.
488 The following characters must be escaped with a backslash
489 ('\') when used as part of a word (e.g. a username or
490 hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
492 S
\bSU
\bUD
\bDO
\bOE
\bER
\bRS
\bS O
\bOP
\bPT
\bTI
\bIO
\bON
\bNS
\bS
493 s
\bsu
\bud
\bdo
\bo's behavior can be modified by Default_Entry lines, as
494 explained earlier. A list of all supported Defaults
495 parameters, grouped by type, are listed below.
497 F
\bFl
\bla
\bag
\bgs
\bs:
499 always_set_home If set, s
\bsu
\bud
\bdo
\bo will set the HOME environment
500 variable to the home directory of the tar
501 get user (which is root unless the -
\b-u
\bu
502 option is used). This effectively means
503 that the -
\b-H
\bH flag is always implied. This
504 flag is _
\bo_
\bf_
\bf by default.
506 authenticate If set, users must authenticate themselves
507 via a password (or other means of authen
508 tication) before they may run commands.
509 This default may be overridden via the
510 PASSWD and NOPASSWD tags. This flag is _
\bo_
\bn
513 env_editor If set, v
\bvi
\bis
\bsu
\bud
\bdo
\bo will use the value of the
514 EDITOR or VISUAL environment variables
515 before falling back on the default editor
516 list. Note that this may create a secu
517 rity hole as it allows the user to run any
518 arbitrary command as root without logging.
519 A safer alternative is to place a colon-
520 separated list of editors in the editor
521 variable. v
\bvi
\bis
\bsu
\bud
\bdo
\bo will then only use the
522 EDITOR or VISUAL if they match a value
526 1.6.9p12 January 14, 2008 8
532 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
535 specified in editor. This flag is _
\bo_
\bf_
\bf by
538 env_reset If set, s
\bsu
\bud
\bdo
\bo will reset the environment to
539 only contain the LOGNAME, SHELL, USER,
540 USERNAME and the SUDO_* variables. Any
541 variables in the caller's environment that
542 match the env_keep and env_check lists are
543 then added. The default contents of the
544 env_keep and env_check lists are displayed
545 when s
\bsu
\bud
\bdo
\bo is run by root with the _
\b-_
\bV
546 option. If s
\bsu
\bud
\bdo
\bo was compiled with the
547 SECURE_PATH option, its value will be used
548 for the PATH environment variable. This
549 flag is _
\bo_
\bn by default.
551 fqdn Set this flag if you want to put fully
552 qualified hostnames in the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
553 I.e., instead of myhost you would use
554 myhost.mydomain.edu. You may still use
555 the short form if you wish (and even mix
556 the two). Beware that turning on _
\bf_
\bq_
\bd_
\bn
557 requires s
\bsu
\bud
\bdo
\bo to make DNS lookups which
558 may make s
\bsu
\bud
\bdo
\bo unusable if DNS stops work
559 ing (for example if the machine is not
560 plugged into the network). Also note that
561 you must use the host's official name as
562 DNS knows it. That is, you may not use a
563 host alias (CNAME entry) due to perfor
564 mance issues and the fact that there is no
565 way to get all aliases from DNS. If your
566 machine's hostname (as returned by the
567 hostname command) is already fully quali
568 fied you shouldn't need to set _
\bf_
\bq_
\bd_
\bn. This
569 flag is _
\bo_
\bf_
\bf by default.
571 ignore_dot If set, s
\bsu
\bud
\bdo
\bo will ignore '.' or '' (cur
572 rent dir) in the PATH environment vari
573 able; the PATH itself is not modified.
574 This flag is _
\bo_
\bf_
\bf by default. Currently,
575 while it is possible to set _
\bi_
\bg_
\bn_
\bo_
\br_
\be_
\b__
\bd_
\bo_
\bt in
576 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs, its value is not used. This
577 option should be considered read-only (it
578 will be fixed in a future version of
582 If set via LDAP, parsing of
583 @sysconfdir@/sudoers will be skipped.
584 This is intended for Enterprises that wish
585 to prevent the usage of local sudoers
586 files so that only LDAP is used. This
587 thwarts the efforts of rogue operators who
588 would attempt to add roles to
592 1.6.9p12 January 14, 2008 9
598 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
601 @sysconfdir@/sudoers. When this option is
602 present, @sysconfdir@/sudoers does not
603 even need to exist. Since this option
604 tells s
\bsu
\bud
\bdo
\bo how to behave when no specific
605 LDAP entries have been matched, this
606 sudoOption is only meaningful for the
607 cn=defaults section. This flag is _
\bo_
\bf_
\bf by
610 insults If set, s
\bsu
\bud
\bdo
\bo will insult users when they
611 enter an incorrect password. This flag is
612 _
\bo_
\bf_
\bf by default.
614 log_host If set, the hostname will be logged in the
615 (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This flag is
616 _
\bo_
\bf_
\bf by default.
618 log_year If set, the four-digit year will be logged
619 in the (non-syslog) s
\bsu
\bud
\bdo
\bo log file. This
620 flag is _
\bo_
\bf_
\bf by default.
622 long_otp_prompt When validating with a One Time Password
623 (OPT) scheme such as S
\bS/
\b/K
\bKe
\bey
\by or O
\bOP
\bPI
\bIE
\bE, a two-
624 line prompt is used to make it easier to
625 cut and paste the challenge to a local
626 window. It's not as pretty as the default
627 but some people find it more convenient.
628 This flag is _
\bo_
\bf_
\bf by default.
630 mail_always Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user every time a
631 users runs s
\bsu
\bud
\bdo
\bo. This flag is _
\bo_
\bf_
\bf by
634 mail_badpass Send mail to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo user if the user
635 running s
\bsu
\bud
\bdo
\bo does not enter the correct
636 password. This flag is _
\bo_
\bf_
\bf by default.
638 mail_no_host If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
639 user if the invoking user exists in the
640 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file, but is not allowed to run
641 commands on the current host. This flag
642 is _
\bo_
\bf_
\bf by default.
644 mail_no_perms If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
645 user if the invoking user is allowed to
646 use s
\bsu
\bud
\bdo
\bo but the command they are trying
647 is not listed in their _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file entry
648 or is explicitly denied. This flag is _
\bo_
\bf_
\bf
651 mail_no_user If set, mail will be sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
652 user if the invoking user is not in the
653 _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file. This flag is _
\bo_
\bn by default.
658 1.6.9p12 January 14, 2008 10
664 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
667 noexec If set, all commands run via s
\bsu
\bud
\bdo
\bo will
668 behave as if the NOEXEC tag has been set,
669 unless overridden by a EXEC tag. See the
670 description of _
\bN_
\bO_
\bE_
\bX_
\bE_
\bC _
\ba_
\bn_
\bd _
\bE_
\bX_
\bE_
\bC below as
671 well as the "PREVENTING SHELL ESCAPES"
672 section at the end of this manual. This
673 flag is _
\bo_
\bf_
\bf by default.
675 path_info Normally, s
\bsu
\bud
\bdo
\bo will tell the user when a
676 command could not be found in their PATH
677 environment variable. Some sites may wish
678 to disable this as it could be used to
679 gather information on the location of exe
680 cutables that the normal user does not
681 have access to. The disadvantage is that
682 if the executable is simply not in the
683 user's PATH, s
\bsu
\bud
\bdo
\bo will tell the user that
684 they are not allowed to run it, which can
685 be confusing. This flag is _
\bo_
\bn by default.
688 The password prompt specified by
689 _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt will normally only be used if
690 the passwod prompt provided by systems
691 such as PAM matches the string "Pass
692 word:". If _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt_
\b__
\bo_
\bv_
\be_
\br_
\br_
\bi_
\bd_
\be is set,
693 _
\bp_
\ba_
\bs_
\bs_
\bp_
\br_
\bo_
\bm_
\bp_
\bt will always be used. This flag
694 is _
\bo_
\bf_
\bf by default.
696 preserve_groups By default s
\bsu
\bud
\bdo
\bo will initialize the group
697 vector to the list of groups the target
698 user is in. When _
\bp_
\br_
\be_
\bs_
\be_
\br_
\bv_
\be_
\b__
\bg_
\br_
\bo_
\bu_
\bp_
\bs is set,
699 the user's existing group vector is left
700 unaltered. The real and effective group
701 IDs, however, are still set to match the
702 target user. This flag is _
\bo_
\bf_
\bf by default.
704 requiretty If set, s
\bsu
\bud
\bdo
\bo will only run when the user
705 is logged in to a real tty. This will
706 disallow things like "rsh somehost sudo
707 ls" since _
\br_
\bs_
\bh(1) does not allocate a tty.
708 Because it is not possible to turn off
709 echo when there is no tty present, some
710 sites may wish to set this flag to prevent
711 a user from entering a visible password.
712 This flag is _
\bo_
\bf_
\bf by default.
714 root_sudo If set, root is allowed to run s
\bsu
\bud
\bdo
\bo too.
715 Disabling this prevents users from "chain
716 ing" s
\bsu
\bud
\bdo
\bo commands to get a root shell by
717 doing something like "sudo sudo /bin/sh".
718 Note, however, that turning off _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo
719 will also prevent root and from running
720 s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt. Disabling _
\br_
\bo_
\bo_
\bt_
\b__
\bs_
\bu_
\bd_
\bo provides no
724 1.6.9p12 January 14, 2008 11
730 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
733 real additional security; it exists purely
734 for historical reasons. This flag is _
\bo_
\bn
737 rootpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the root
738 password instead of the password of the
739 invoking user. This flag is _
\bo_
\bf_
\bf by
742 runaspw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
743 of the user defined by the _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt
744 option (defaults to root) instead of the
745 password of the invoking user. This flag
746 is _
\bo_
\bf_
\bf by default.
748 set_home If set and s
\bsu
\bud
\bdo
\bo is invoked with the -
\b-s
\bs
749 flag the HOME environment variable will be
750 set to the home directory of the target
751 user (which is root unless the -
\b-u
\bu option
752 is used). This effectively makes the -
\b-s
\bs
753 flag imply -
\b-H
\bH. This flag is _
\bo_
\bf_
\bf by
756 set_logname Normally, s
\bsu
\bud
\bdo
\bo will set the LOGNAME, USER
757 and USERNAME environment variables to the
758 name of the target user (usually root
759 unless the -
\b-u
\bu flag is given). However,
760 since some programs (including the RCS
761 revision control system) use LOGNAME to
762 determine the real identity of the user,
763 it may be desirable to change this behav
764 ior. This can be done by negating the
765 set_logname option. Note that if the
766 _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt option has not been disabled,
767 entries in the _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp list will override
768 the value of _
\bs_
\be_
\bt_
\b__
\bl_
\bo_
\bg_
\bn_
\ba_
\bm_
\be. This flag is
769 _
\bo_
\bf_
\bf by default.
771 setenv Allow the user to disable the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
772 option from the command line. Addition
773 ally, environment variables set via the
774 command line are not subject to the
775 restrictions imposed by _
\be_
\bn_
\bv_
\b__
\bc_
\bh_
\be_
\bc_
\bk,
776 _
\be_
\bn_
\bv_
\b__
\bd_
\be_
\bl_
\be_
\bt_
\be, or _
\be_
\bn_
\bv_
\b__
\bk_
\be_
\be_
\bp. As such, only
777 trusted users should be allowed to set
778 variables in this manner. This flag is
779 _
\bo_
\bf_
\bf by default.
781 shell_noargs If set and s
\bsu
\bud
\bdo
\bo is invoked with no argu
782 ments it acts as if the -
\b-s
\bs flag had been
783 given. That is, it runs a shell as root
784 (the shell is determined by the SHELL
785 environment variable if it is set, falling
786 back on the shell listed in the invoking
790 1.6.9p12 January 14, 2008 12
796 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
799 user's /etc/passwd entry if not). This
800 flag is _
\bo_
\bf_
\bf by default.
802 stay_setuid Normally, when s
\bsu
\bud
\bdo
\bo executes a command the
803 real and effective UIDs are set to the
804 target user (root by default). This
805 option changes that behavior such that the
806 real UID is left as the invoking user's
807 UID. In other words, this makes s
\bsu
\bud
\bdo
\bo act
808 as a setuid wrapper. This can be useful
809 on systems that disable some potentially
810 dangerous functionality when a program is
811 run setuid. This option is only effective
812 on systems with either the _
\bs_
\be_
\bt_
\br_
\be_
\bu_
\bi_
\bd_
\b(_
\b) or
813 _
\bs_
\be_
\bt_
\br_
\be_
\bs_
\bu_
\bi_
\bd_
\b(_
\b) function. This flag is _
\bo_
\bf_
\bf by
816 targetpw If set, s
\bsu
\bud
\bdo
\bo will prompt for the password
817 of the user specified by the -
\b-u
\bu flag
818 (defaults to root) instead of the password
819 of the invoking user. Note that this pre
820 cludes the use of a uid not listed in the
821 passwd database as an argument to the -
\b-u
\bu
822 flag. This flag is _
\bo_
\bf_
\bf by default.
824 tty_tickets If set, users must authenticate on a per-
825 tty basis. Normally, s
\bsu
\bud
\bdo
\bo uses a direc
826 tory in the ticket dir with the same name
827 as the user running it. With this flag
828 enabled, s
\bsu
\bud
\bdo
\bo will use a file named for
829 the tty the user is logged in on in that
830 directory. This flag is _
\bo_
\bf_
\bf by default.
832 use_loginclass If set, s
\bsu
\bud
\bdo
\bo will apply the defaults spec
833 ified for the target user's login class if
834 one exists. Only available if s
\bsu
\bud
\bdo
\bo is
835 configured with the --with-logincap
836 option. This flag is _
\bo_
\bf_
\bf by default.
838 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs:
840 passwd_tries The number of tries a user gets to enter
841 his/her password before s
\bsu
\bud
\bdo
\bo logs the
842 failure and exits. The default is 3.
844 I
\bIn
\bnt
\bte
\beg
\bge
\ber
\brs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
846 loglinelen Number of characters per line for the file
847 log. This value is used to decide when to
848 wrap lines for nicer log files. This has
849 no effect on the syslog log file, only the
850 file log. The default is 80 (use 0 or
851 negate the option to disable word wrap).
856 1.6.9p12 January 14, 2008 13
862 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
865 passwd_timeout Number of minutes before the s
\bsu
\bud
\bdo
\bo password
866 prompt times out. The default is 5; set
867 this to 0 for no password timeout.
870 Number of minutes that can elapse before
871 s
\bsu
\bud
\bdo
\bo will ask for a passwd again. The
872 default is 5. Set this to 0 to always
873 prompt for a password. If set to a value
874 less than 0 the user's timestamp will
875 never expire. This can be used to allow
876 users to create or delete their own times
877 tamps via sudo -v and sudo -k respec
880 umask Umask to use when running the command.
881 Negate this option or set it to 0777 to
882 preserve the user's umask. The default is
885 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs:
887 badpass_message Message that is displayed if a user enters
888 an incorrect password. The default is
889 Sorry, try again. unless insults are
892 editor A colon (':') separated list of editors
893 allowed to be used with v
\bvi
\bis
\bsu
\bud
\bdo
\bo. v
\bvi
\bis
\bsu
\bud
\bdo
\bo
894 will choose the editor that matches the
895 user's EDITOR environment variable if pos
896 sible, or the first editor in the list
897 that exists and is executable. The
898 default is the path to vi on your system.
900 mailsub Subject of the mail sent to the _
\bm_
\ba_
\bi_
\bl_
\bt_
\bo
901 user. The escape %h will expand to the
902 hostname of the machine. Default is ***
903 SECURITY information for %h ***.
905 noexec_file Path to a shared library containing dummy
906 versions of the _
\be_
\bx_
\be_
\bc_
\bv_
\b(_
\b), _
\be_
\bx_
\be_
\bc_
\bv_
\be_
\b(_
\b) and _
\bf_
\be_
\bx_
\b
907 _
\be_
\bc_
\bv_
\be_
\b(_
\b) library functions that just return
908 an error. This is used to implement the
909 _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality on systems that sup
910 port LD_PRELOAD or its equivalent.
912 _
\b/_
\bu_
\bs_
\br_
\b/_
\bl_
\bo_
\bc_
\ba_
\bl_
\b/_
\bl_
\bi_
\bb_
\be_
\bx_
\be_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\b__
\bn_
\bo_
\be_
\bx_
\be_
\bc_
\b._
\bs_
\bo.
914 passprompt The default prompt to use when asking for
915 a password; can be overridden via the -
\b-p
\bp
916 option or the SUDO_PROMPT environment
917 variable. The following percent (`%')
918 escapes are supported:
922 1.6.9p12 January 14, 2008 14
928 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
931 %H expanded to the local hostname includ
932 ing the domain name (on if the
933 machine's hostname is fully qualified
934 or the _
\bf_
\bq_
\bd_
\bn option is set)
936 %h expanded to the local hostname without
939 %p expanded to the user whose password is
940 being asked for (respects the _
\br_
\bo_
\bo_
\bt_
\bp_
\bw,
941 _
\bt_
\ba_
\br_
\bg_
\be_
\bt_
\bp_
\bw and _
\br_
\bu_
\bn_
\ba_
\bs_
\bp_
\bw flags in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs)
943 %U expanded to the login name of the user
944 the command will be run as (defaults
947 %u expanded to the invoking user's login
950 %% two consecutive % characters are col
951 lapsed into a single % character
953 The default value is Password:.
955 runas_default The default user to run commands as if the
956 -
\b-u
\bu flag is not specified on the command
957 line. This defaults to root. Note that
958 if _
\br_
\bu_
\bn_
\ba_
\bs_
\b__
\bd_
\be_
\bf_
\ba_
\bu_
\bl_
\bt is set it m
\bmu
\bus
\bst
\bt occur
959 before any Runas_Alias specifications.
961 syslog_badpri Syslog priority to use when user authenti
962 cates unsuccessfully. Defaults to alert.
964 syslog_goodpri Syslog priority to use when user authenti
965 cates successfully. Defaults to notice.
967 timestampdir The directory in which s
\bsu
\bud
\bdo
\bo stores its
968 timestamp files. The default is
969 _
\b/_
\bv_
\ba_
\br_
\b/_
\br_
\bu_
\bn_
\b/_
\bs_
\bu_
\bd_
\bo.
971 timestampowner The owner of the timestamp directory and
972 the timestamps stored therein. The
975 S
\bSt
\btr
\bri
\bin
\bng
\bgs
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
978 Users in this group are exempt from password
979 and PATH requirements. This is not set by
982 lecture This option controls when a short lecture will
983 be printed along with the password prompt. It
984 has the following possible values:
988 1.6.9p12 January 14, 2008 15
994 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
997 always Always lecture the user.
999 never Never lecture the user.
1001 once Only lecture the user the first time
1002 they run s
\bsu
\bud
\bdo
\bo.
1004 If no value is specified, a value of _
\bo_
\bn_
\bc_
\be is
1005 implied. Negating the option results in a
1006 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1007 is _
\bo_
\bn_
\bc_
\be.
1010 Path to a file containing an alternate s
\bsu
\bud
\bdo
\bo
1011 lecture that will be used in place of the
1012 standard lecture if the named file exists. By
1013 default, s
\bsu
\bud
\bdo
\bo uses a built-in lecture.
1015 listpw This option controls when a password will be
1016 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-l
\bl
1017 flag. It has the following possible values:
1019 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1020 current host must have the NOPASSWD
1021 flag set to avoid entering a password.
1023 always The user must always enter a password
1024 to use the -
\b-l
\bl flag.
1026 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1027 entries for the current host must have
1028 the NOPASSWD flag set to avoid enter
1031 never The user need never enter a password
1032 to use the -
\b-l
\bl flag.
1034 If no value is specified, a value of _
\ba_
\bn_
\by is
1035 implied. Negating the option results in a
1036 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1039 logfile Path to the s
\bsu
\bud
\bdo
\bo log file (not the syslog log
1040 file). Setting a path turns on logging to a
1041 file; negating this option turns it off. By
1042 default, s
\bsu
\bud
\bdo
\bo logs via syslog.
1044 mailerflags Flags to use when invoking mailer. Defaults to
1047 mailerpath Path to mail program used to send warning
1048 mail. Defaults to the path to sendmail found
1054 1.6.9p12 January 14, 2008 16
1060 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1063 mailto Address to send warning and error mail to.
1064 The address should be enclosed in double
1065 quotes (") to protect against s
\bsu
\bud
\bdo
\bo interpret
1066 ing the @ sign. Defaults to root.
1068 syslog Syslog facility if syslog is being used for
1069 logging (negate to disable syslog logging).
1072 verifypw This option controls when a password will be
1073 required when a user runs s
\bsu
\bud
\bdo
\bo with the -
\b-v
\bv
1074 flag. It has the following possible values:
1076 all All the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries for the
1077 current host must have the NOPASSWD
1078 flag set to avoid entering a password.
1080 always The user must always enter a password
1081 to use the -
\b-v
\bv flag.
1083 any At least one of the user's _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1084 entries for the current host must have
1085 the NOPASSWD flag set to avoid enter
1088 never The user need never enter a password
1089 to use the -
\b-v
\bv flag.
1091 If no value is specified, a value of _
\ba_
\bl_
\bl is
1092 implied. Negating the option results in a
1093 value of _
\bn_
\be_
\bv_
\be_
\br being used. The default value
1096 L
\bLi
\bis
\bst
\bts
\bs t
\bth
\bha
\bat
\bt c
\bca
\ban
\bn b
\bbe
\be u
\bus
\bse
\bed
\bd i
\bin
\bn a
\ba b
\bbo
\boo
\bol
\ble
\bea
\ban
\bn c
\bco
\bon
\bnt
\bte
\bex
\bxt
\bt:
1098 env_check Environment variables to be removed from
1099 the user's environment if the variable's
1100 value contains % or / characters. This
1101 can be used to guard against printf-style
1102 format vulnerabilities in poorly-written
1103 programs. The argument may be a dou
1104 ble-quoted, space-separated list or a sin
1105 gle value without double-quotes. The list
1106 can be replaced, added to, deleted from,
1107 or disabled by using the =, +=, -=, and !
1108 operators respectively. Regardless of
1109 whether the env_reset option is enabled or
1110 disabled, variables specified by env_check
1111 will be preserved in the environment if
1112 they pass the aforementioned check. The
1113 default list of environment variables to
1114 check is displayed when s
\bsu
\bud
\bdo
\bo is run by
1115 root with the _
\b-_
\bV option.
1120 1.6.9p12 January 14, 2008 17
1126 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1129 env_delete Environment variables to be removed from
1130 the user's environment. The argument may
1131 be a double-quoted, space-separated list
1132 or a single value without double-quotes.
1133 The list can be replaced, added to,
1134 deleted from, or disabled by using the =,
1135 +=, -=, and ! operators respectively. The
1136 default list of environment variables to
1137 remove is displayed when s
\bsu
\bud
\bdo
\bo is run by
1138 root with the _
\b-_
\bV option. Note that many
1139 operating systems will remove potentially
1140 dangerous variables from the environment
1141 of any setuid process (such as s
\bsu
\bud
\bdo
\bo).
1143 env_keep Environment variables to be preserved in
1144 the user's environment when the _
\be_
\bn_
\bv_
\b__
\br_
\be_
\bs_
\be_
\bt
1145 option is in effect. This allows fine-
1146 grained control over the environment
1147 s
\bsu
\bud
\bdo
\bo-spawned processes will receive. The
1148 argument may be a double-quoted, space-
1149 separated list or a single value without
1150 double-quotes. The list can be replaced,
1151 added to, deleted from, or disabled by
1152 using the =, +=, -=, and ! operators
1153 respectively. The default list of vari
1154 ables to keep is displayed when s
\bsu
\bud
\bdo
\bo is
1155 run by root with the _
\b-_
\bV option.
1157 When logging via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3), s
\bsu
\bud
\bdo
\bo accepts the following
1158 values for the syslog facility (the value of the s
\bsy
\bys
\bsl
\blo
\bog
\bg
1159 Parameter): a
\bau
\but
\bth
\bhp
\bpr
\bri
\biv
\bv (if your OS supports it), a
\bau
\but
\bth
\bh, d
\bda
\bae
\be
\b
1160 m
\bmo
\bon
\bn, u
\bus
\bse
\ber
\br, l
\blo
\boc
\bca
\bal
\bl0
\b0, l
\blo
\boc
\bca
\bal
\bl1
\b1, l
\blo
\boc
\bca
\bal
\bl2
\b2, l
\blo
\boc
\bca
\bal
\bl3
\b3, l
\blo
\boc
\bca
\bal
\bl4
\b4, l
\blo
\boc
\bca
\bal
\bl5
\b5,
1161 l
\blo
\boc
\bca
\bal
\bl6
\b6, and l
\blo
\boc
\bca
\bal
\bl7
\b7. The following syslog priorities are
1162 supported: a
\bal
\ble
\ber
\brt
\bt, c
\bcr
\bri
\bit
\bt, d
\bde
\beb
\bbu
\bug
\bg, e
\bem
\bme
\ber
\brg
\bg, e
\ber
\brr
\br, i
\bin
\bnf
\bfo
\bo, n
\bno
\bot
\bti
\bic
\bce
\be,
1163 and w
\bwa
\bar
\brn
\bni
\bin
\bng
\bg.
1165 F
\bFI
\bIL
\bLE
\bES
\bS
1166 _
\b/_
\be_
\bt_
\bc_
\b/_
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs List of who can run what
1167 _
\b/_
\be_
\bt_
\bc_
\b/_
\bg_
\br_
\bo_
\bu_
\bp Local groups file
1168 _
\b/_
\be_
\bt_
\bc_
\b/_
\bn_
\be_
\bt_
\bg_
\br_
\bo_
\bu_
\bp List of network groups
1170 E
\bEX
\bXA
\bAM
\bMP
\bPL
\bLE
\bES
\bS
1171 Since the _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file is parsed in a single pass, order
1172 is important. In general, you should structure _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs
1173 such that the Host_Alias, User_Alias, and Cmnd_Alias spec
1174 ifications come first, followed by any Default_Entry
1175 lines, and finally the Runas_Alias and user specifica
1176 tions. The basic rule of thumb is you cannot reference an
1177 Alias that has not already been defined.
1179 Below are example _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs entries. Admittedly, some of
1180 these are a bit contrived. First, we define our _
\ba_
\bl_
\bi_
\ba_
\bs_
\be_
\bs:
1186 1.6.9p12 January 14, 2008 18
1192 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1195 # User alias specification
1196 User_Alias FULLTIMERS = millert, mikef, dowdy
1197 User_Alias PARTTIMERS = bostley, jwfox, crawl
1198 User_Alias WEBMASTERS = will, wendy, wim
1200 # Runas alias specification
1201 Runas_Alias OP = root, operator
1202 Runas_Alias DB = oracle, sybase
1204 # Host alias specification
1205 Host_Alias SPARC = bigtime, eclipse, moet, anchor :\
1206 SGI = grolsch, dandelion, black :\
1207 ALPHA = widget, thalamus, foobar :\
1208 HPPA = boa, nag, python
1209 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
1210 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
1211 Host_Alias SERVERS = master, mail, www, ns
1212 Host_Alias CDROM = orion, perseus, hercules
1214 # Cmnd alias specification
1215 Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
1216 /usr/sbin/restore, /usr/sbin/rrestore
1217 Cmnd_Alias KILL = /usr/bin/kill
1218 Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
1219 Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
1220 Cmnd_Alias HALT = /usr/sbin/halt
1221 Cmnd_Alias REBOOT = /usr/sbin/reboot
1222 Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
1223 /usr/local/bin/tcsh, /usr/bin/rsh, \
1225 Cmnd_Alias SU = /usr/bin/su
1226 Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
1228 Here we override some of the compiled in default values.
1229 We want s
\bsu
\bud
\bdo
\bo to log via _
\bs_
\by_
\bs_
\bl_
\bo_
\bg(3) using the _
\ba_
\bu_
\bt_
\bh facility
1230 in all cases. We don't want to subject the full time
1231 staff to the s
\bsu
\bud
\bdo
\bo lecture, user m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt need not give a
1232 password, and we don't want to reset the LOGNAME, USER or
1233 USERNAME environment variables when running commands as
1234 root. Additionally, on the machines in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS
1235 Host_Alias, we keep an additional local log file and make
1236 sure we log the year in each log line since the log
1237 entries will be kept around for several years. Lastly, we
1238 disable shell escapes for the commands in the PAGERS
1239 Cmnd_Alias (_
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be, _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bp_
\bg and _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bl_
\be_
\bs_
\bs).
1241 # Override built-in defaults
1242 Defaults syslog=auth
1243 Defaults>root !set_logname
1244 Defaults:FULLTIMERS !lecture
1245 Defaults:millert !authenticate
1246 Defaults@SERVERS log_year, logfile=/var/log/sudo.log
1247 Defaults!PAGERS noexec
1252 1.6.9p12 January 14, 2008 19
1258 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1261 The _
\bU_
\bs_
\be_
\br _
\bs_
\bp_
\be_
\bc_
\bi_
\bf_
\bi_
\bc_
\ba_
\bt_
\bi_
\bo_
\bn is the part that actually deter
1262 mines who may run what.
1264 root ALL = (ALL) ALL
1265 %wheel ALL = (ALL) ALL
1267 We let r
\bro
\boo
\bot
\bt and any user in group w
\bwh
\bhe
\bee
\bel
\bl run any command on
1268 any host as any user.
1270 FULLTIMERS ALL = NOPASSWD: ALL
1272 Full time sysadmins (m
\bmi
\bil
\bll
\ble
\ber
\brt
\bt, m
\bmi
\bik
\bke
\bef
\bf, and d
\bdo
\bow
\bwd
\bdy
\by) may run
1273 any command on any host without authenticating themselves.
1275 PARTTIMERS ALL = ALL
1277 Part time sysadmins (b
\bbo
\bos
\bst
\btl
\ble
\bey
\by, j
\bjw
\bwf
\bfo
\box
\bx, and c
\bcr
\bra
\baw
\bwl
\bl) may run
1278 any command on any host but they must authenticate them
1279 selves first (since the entry lacks the NOPASSWD tag).
1283 The user j
\bja
\bac
\bck
\bk may run any command on the machines in the
1284 _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS alias (the networks 128.138.243.0, 128.138.204.0,
1285 and 128.138.242.0). Of those networks, only 128.138.204.0
1286 has an explicit netmask (in CIDR notation) indicating it
1287 is a class C network. For the other networks in _
\bC_
\bS_
\bN_
\bE_
\bT_
\bS,
1288 the local machine's netmask will be used during matching.
1292 The user l
\bli
\bis
\bsa
\ba may run any command on any host in the
1293 _
\bC_
\bU_
\bN_
\bE_
\bT_
\bS alias (the class B network 128.138.0.0).
1295 operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
1296 sudoedit /etc/printcap, /usr/oper/bin/
1298 The o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br user may run commands limited to simple main
1299 tenance. Here, those are commands related to backups,
1300 killing processes, the printing system, shutting down the
1301 system, and any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bo_
\bp_
\be_
\br_
\b/_
\bb_
\bi_
\bn_
\b/.
1303 joe ALL = /usr/bin/su operator
1305 The user j
\bjo
\boe
\be may only _
\bs_
\bu(1) to operator.
1307 pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
1309 The user p
\bpe
\bet
\bte
\be is allowed to change anyone's password
1310 except for root on the _
\bH_
\bP_
\bP_
\bA machines. Note that this
1311 assumes _
\bp_
\ba_
\bs_
\bs_
\bw_
\bd(1) does not take multiple usernames on the
1314 bob SPARC = (OP) ALL : SGI = (OP) ALL
1318 1.6.9p12 January 14, 2008 20
1324 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1327 The user b
\bbo
\bob
\bb may run anything on the _
\bS_
\bP_
\bA_
\bR_
\bC and _
\bS_
\bG_
\bI
1328 machines as any user listed in the _
\bO_
\bP Runas_Alias (r
\bro
\boo
\bot
\bt
1329 and o
\bop
\bpe
\ber
\bra
\bat
\bto
\bor
\br).
1333 The user j
\bji
\bim
\bm may run any command on machines in the _
\bb_
\bi_
\bg_
\bl_
\ba_
\bb
1334 netgroup. s
\bsu
\bud
\bdo
\bo knows that "biglab" is a netgroup due to
1337 +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
1339 Users in the s
\bse
\bec
\bcr
\bre
\bet
\bta
\bar
\bri
\bie
\bes
\bs netgroup need to help manage the
1340 printers as well as add and remove users, so they are
1341 allowed to run those commands on all machines.
1343 fred ALL = (DB) NOPASSWD: ALL
1345 The user f
\bfr
\bre
\bed
\bd can run commands as any user in the _
\bD_
\bB
1346 Runas_Alias (o
\bor
\bra
\bac
\bcl
\ble
\be or s
\bsy
\byb
\bba
\bas
\bse
\be) without giving a password.
1348 john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
1350 On the _
\bA_
\bL_
\bP_
\bH_
\bA machines, user j
\bjo
\boh
\bhn
\bn may su to anyone except
1351 root but he is not allowed to give _
\bs_
\bu(1) any flags.
1353 jen ALL, !SERVERS = ALL
1355 The user j
\bje
\ben
\bn may run any command on any machine except for
1356 those in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias (master, mail, www and
1359 jill SERVERS = /usr/bin/, !SU, !SHELLS
1361 For any machine in the _
\bS_
\bE_
\bR_
\bV_
\bE_
\bR_
\bS Host_Alias, j
\bji
\bil
\bll
\bl may run
1362 any commands in the directory _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/ except for those
1363 commands belonging to the _
\bS_
\bU and _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS Cmnd_Aliases.
1365 steve CSNETS = (operator) /usr/local/op_commands/
1367 The user s
\bst
\bte
\bev
\bve
\be may run any command in the directory
1368 /usr/local/op_commands/ but only as user operator.
1370 matt valkyrie = KILL
1372 On his personal workstation, valkyrie, m
\bma
\bat
\btt
\bt needs to be
1373 able to kill hung processes.
1375 WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
1377 On the host www, any user in the _
\bW_
\bE_
\bB_
\bM_
\bA_
\bS_
\bT_
\bE_
\bR_
\bS User_Alias
1378 (will, wendy, and wim), may run any command as user www
1379 (which owns the web pages) or simply _
\bs_
\bu(1) to www.
1384 1.6.9p12 January 14, 2008 21
1390 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1393 ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\
1394 /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
1396 Any user may mount or unmount a CD-ROM on the machines in
1397 the CDROM Host_Alias (orion, perseus, hercules) without
1398 entering a password. This is a bit tedious for users to
1399 type, so it is a prime candidate for encapsulating in a
1402 S
\bSE
\bEC
\bCU
\bUR
\bRI
\bIT
\bTY
\bY N
\bNO
\bOT
\bTE
\bES
\bS
1403 It is generally not effective to "subtract" commands from
1404 ALL using the '!' operator. A user can trivially circum
1405 vent this by copying the desired command to a different
1406 name and then executing that. For example:
1408 bill ALL = ALL, !SU, !SHELLS
1410 Doesn't really prevent b
\bbi
\bil
\bll
\bl from running the commands
1411 listed in _
\bS_
\bU or _
\bS_
\bH_
\bE_
\bL_
\bL_
\bS since he can simply copy those com
1412 mands to a different name, or use a shell escape from an
1413 editor or other program. Therefore, these kind of
1414 restrictions should be considered advisory at best (and
1415 reinforced by policy).
1417 P
\bPR
\bRE
\bEV
\bVE
\bEN
\bNT
\bTI
\bIN
\bNG
\bG S
\bSH
\bHE
\bEL
\bLL
\bL E
\bES
\bSC
\bCA
\bAP
\bPE
\bES
\bS
1418 Once s
\bsu
\bud
\bdo
\bo executes a program, that program is free to do
1419 whatever it pleases, including run other programs. This
1420 can be a security issue since it is not uncommon for a
1421 program to allow shell escapes, which lets a user bypass
1422 s
\bsu
\bud
\bdo
\bo's access control and logging. Common programs that
1423 permit shell escapes include shells (obviously), editors,
1424 paginators, mail and terminal programs.
1426 There are two basic approaches to this problem:
1428 restrict Avoid giving users access to commands that allow
1429 the user to run arbitrary commands. Many edi
1430 tors have a restricted mode where shell escapes
1431 are disabled, though s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt is a better solu
1432 tion to running editors via s
\bsu
\bud
\bdo
\bo. Due to the
1433 large number of programs that offer shell
1434 escapes, restricting users to the set of pro
1435 grams that do not if often unworkable.
1437 noexec Many systems that support shared libraries have
1438 the ability to override default library func
1439 tions by pointing an environment variable (usu
1440 ally LD_PRELOAD) to an alternate shared library.
1441 On such systems, s
\bsu
\bud
\bdo
\bo's _
\bn_
\bo_
\be_
\bx_
\be_
\bc functionality can
1442 be used to prevent a program run by s
\bsu
\bud
\bdo
\bo from
1443 executing any other programs. Note, however,
1444 that this applies only to native dynamically-
1445 linked executables. Statically-linked executa
1446 bles and foreign executables running under
1450 1.6.9p12 January 14, 2008 22
1456 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1459 binary emulation are not affected.
1461 To tell whether or not s
\bsu
\bud
\bdo
\bo supports _
\bn_
\bo_
\be_
\bx_
\be_
\bc, you
1462 can run the following as root:
1464 sudo -V | grep "dummy exec"
1466 If the resulting output contains a line that
1469 File containing dummy exec functions:
1471 then s
\bsu
\bud
\bdo
\bo may be able to replace the exec family
1472 of functions in the standard library with its
1473 own that simply return an error. Unfortunately,
1474 there is no foolproof way to know whether or not
1475 _
\bn_
\bo_
\be_
\bx_
\be_
\bc will work at compile-time. _
\bn_
\bo_
\be_
\bx_
\be_
\bc should
1476 work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64
1477 UNIX, MacOS X, and HP-UX 11.x. It is known n
\bno
\bot
\bt
1478 to work on AIX and UnixWare. _
\bn_
\bo_
\be_
\bx_
\be_
\bc is expected
1479 to work on most operating systems that support
1480 the LD_PRELOAD environment variable. Check your
1481 operating system's manual pages for the dynamic
1482 linker (usually ld.so, ld.so.1, dyld, dld.sl,
1483 rld, or loader) to see if LD_PRELOAD is sup
1486 To enable _
\bn_
\bo_
\be_
\bx_
\be_
\bc for a command, use the NOEXEC
1487 tag as documented in the User Specification sec
1488 tion above. Here is that example again:
1490 aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
1492 This allows user a
\baa
\bar
\bro
\bon
\bn to run _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bm_
\bo_
\br_
\be and
1493 _
\b/_
\bu_
\bs_
\br_
\b/_
\bb_
\bi_
\bn_
\b/_
\bv_
\bi with _
\bn_
\bo_
\be_
\bx_
\be_
\bc enabled. This will pre
1494 vent those two commands from executing other
1495 commands (such as a shell). If you are unsure
1496 whether or not your system is capable of sup
1497 porting _
\bn_
\bo_
\be_
\bx_
\be_
\bc you can always just try it out
1498 and see if it works.
1500 Note that restricting shell escapes is not a panacea.
1501 Programs running as root are still capable of many poten
1502 tially hazardous operations (such as changing or overwrit
1503 ing files) that could lead to unintended privilege escala
1504 tion. In the specific case of an editor, a safer approach
1505 is to give the user permission to run s
\bsu
\bud
\bdo
\boe
\bed
\bdi
\bit
\bt.
1507 S
\bSE
\bEE
\bE A
\bAL
\bLS
\bSO
\bO
1508 _
\br_
\bs_
\bh(1), _
\bs_
\bu(1), _
\bf_
\bn_
\bm_
\ba_
\bt_
\bc_
\bh(3), _
\bs_
\bu_
\bd_
\bo(1m), _
\bv_
\bi_
\bs_
\bu_
\bd_
\bo(8)
1510 C
\bCA
\bAV
\bVE
\bEA
\bAT
\bTS
\bS
1511 The _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file should a
\bal
\blw
\bwa
\bay
\bys
\bs be edited by the v
\bvi
\bis
\bsu
\bud
\bdo
\bo
1512 command which locks the file and does grammatical
1516 1.6.9p12 January 14, 2008 23
1522 SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4)
1525 checking. It is imperative that _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs be free of syntax
1526 errors since s
\bsu
\bud
\bdo
\bo will not run with a syntactically incor
1527 rect _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs file.
1529 When using netgroups of machines (as opposed to users), if
1530 you store fully qualified hostnames in the netgroup (as is
1531 usually the case), you either need to have the machine's
1532 hostname be fully qualified as returned by the hostname
1533 command or use the _
\bf_
\bq_
\bd_
\bn option in _
\bs_
\bu_
\bd_
\bo_
\be_
\br_
\bs.
1536 If you feel you have found a bug in s
\bsu
\bud
\bdo
\bo, please submit a
1537 bug report at http://www.sudo.ws/sudo/bugs/
1539 S
\bSU
\bUP
\bPP
\bPO
\bOR
\bRT
\bT
1540 Limited free support is available via the sudo-users mail
1541 ing list, see http://www.sudo.ws/mail
1542 man/listinfo/sudo-users to subscribe or search the
1545 D
\bDI
\bIS
\bSC
\bCL
\bLA
\bAI
\bIM
\bME
\bER
\bR
1546 s
\bsu
\bud
\bdo
\bo is provided ``AS IS'' and any express or implied war
1547 ranties, including, but not limited to, the implied war
1548 ranties of merchantability and fitness for a particular
1549 purpose are disclaimed. See the LICENSE file distributed
1550 with s
\bsu
\bud
\bdo
\bo or http://www.sudo.ws/sudo/license.html for com
1582 1.6.9p12 January 14, 2008 24