Bob Proulx pointed out the README made mention of sudoers not a conffile

[debian/sudo] / sudo.cat

diff --git a/sudo.cat b/sudo.cat
index 24e18e3463fa60d7de81825c483eec504c6e27f0..9f85ccdec747b050ea6f43d6fc900b9f3156a573 100644 (file)
--- a/sudo.cat
+++ b/sudo.cat
@@ -10,16 +10,18 @@ N\bNA\bAM\bME\bE
 S\bSY\bYN\bNO\bOP\bPS\bSI\bIS\bS
        s\bsu\bud\bdo\bo -\b-h\bh | -\b-K\bK | -\b-k\bk | -\b-L\bL | -\b-V\bV
 
 S\bSY\bYN\bNO\bOP\bPS\bSI\bIS\bS
        s\bsu\bud\bdo\bo -\b-h\bh | -\b-K\bK | -\b-k\bk | -\b-L\bL | -\b-V\bV
 

-       s\bsu\bud\bdo\bo -\b-v\bv [-\b-A\bAk\bkn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt]
+       s\bsu\bud\bdo\bo -\b-v\bv [-\b-A\bAk\bkn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-g\bg _\bg_\br_\bo_\bu_\bp _\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt]
+       [-\b-u\bu _\bu_\bs_\be_\br_\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd]

 
 

-       s\bsu\bud\bdo\bo -\b-l\bl[\b[l\bl]\b] [-\b-A\bAk\bkn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-g\bg _\bg_\br_\bo_\bu_\bp_\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt]
-       [-\b-U\bU _\bu_\bs_\be_\br_\bn_\ba_\bm_\be] [-\b-u\bu _\bu_\bs_\be_\br_\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]
+       s\bsu\bud\bdo\bo -\b-l\bl[\b[l\bl]\b] [-\b-A\bAk\bkn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-g\bg _\bg_\br_\bo_\bu_\bp _\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt]
+       [-\b-U\bU _\bu_\bs_\be_\br _\bn_\ba_\bm_\be] [-\b-u\bu _\bu_\bs_\be_\br _\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]

 
 

-       s\bsu\bud\bdo\bo [-\b-A\bAb\bbE\bEH\bHn\bnP\bPS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-C\bC _\bf_\bd] [-\b-c\bc _\bc_\bl_\ba_\bs_\bs|_\b-] [-\b-g\bg _\bg_\br_\bo_\bu_\bp_\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd]
-       [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt] [-\b-u\bu _\bu_\bs_\be_\br_\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] [V\bVA\bAR\bR=_\bv_\ba_\bl_\bu_\be] [-\b-i\bi | -\b-s\bs] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]
+       s\bsu\bud\bdo\bo [-\b-A\bAb\bbE\bEH\bHn\bnP\bPS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-C\bC _\bf_\bd] [-\b-c\bc _\bc_\bl_\ba_\bs_\bs|_\b-]
+       [-\b-g\bg _\bg_\br_\bo_\bu_\bp _\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt] [-\b-r\br _\br_\bo_\bl_\be] [-\b-t\bt _\bt_\by_\bp_\be]
+       [-\b-u\bu _\bu_\bs_\be_\br _\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] [V\bVA\bAR\bR=_\bv_\ba_\bl_\bu_\be] [-\b-i\bi | -\b-s\bs] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]

 
 

-       s\bsu\bud\bdo\boe\bed\bdi\bit\bt [-\b-A\bAn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-C\bC _\bf_\bd] [-\b-c\bc _\bc_\bl_\ba_\bs_\bs|_\b-] [-\b-g\bg _\bg_\br_\bo_\bu_\bp_\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd]
-       [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt] [-\b-u\bu _\bu_\bs_\be_\br_\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] file ...
+       s\bsu\bud\bdo\boe\bed\bdi\bit\bt [-\b-A\bAn\bnS\bS] [-\b-a\ba _\ba_\bu_\bt_\bh_\b__\bt_\by_\bp_\be] [-\b-C\bC _\bf_\bd] [-\b-c\bc _\bc_\bl_\ba_\bs_\bs|_\b-]
+       [-\b-g\bg _\bg_\br_\bo_\bu_\bp _\bn_\ba_\bm_\be|_\b#_\bg_\bi_\bd] [-\b-p\bp _\bp_\br_\bo_\bm_\bp_\bt] [-\b-u\bu _\bu_\bs_\be_\br _\bn_\ba_\bm_\be|_\b#_\bu_\bi_\bd] file ...

 
 D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
        s\bsu\bud\bdo\bo allows a permitted user to execute a _\bc_\bo_\bm_\bm_\ba_\bn_\bd as the superuser or
 
 D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
        s\bsu\bud\bdo\bo allows a permitted user to execute a _\bc_\bo_\bm_\bm_\ba_\bn_\bd as the superuser or


@@ -31,17 +33,18 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
        password is required.  Otherwise, s\bsu\bud\bdo\bo requires that users authenticate
        themselves with a password by default (NOTE: in the default
        configuration this is the user's password, not the root password).
        password is required.  Otherwise, s\bsu\bud\bdo\bo requires that users authenticate
        themselves with a password by default (NOTE: in the default
        configuration this is the user's password, not the root password).

-       Once a user has been authenticated, a timestamp is updated and the user
-       may then use sudo without a password for a short period of time (5
+       Once a user has been authenticated, a time stamp is updated and the
+       user may then use sudo without a password for a short period of time (5

        minutes unless overridden in _\bs_\bu_\bd_\bo_\be_\br_\bs).
 
        When invoked as s\bsu\bud\bdo\boe\bed\bdi\bit\bt, the -\b-e\be option (described below), is implied.
 
        s\bsu\bud\bdo\bo determines who is an authorized user by consulting the file
        _\b/_\be_\bt_\bc_\b/_\bs_\bu_\bd_\bo_\be_\br_\bs.  By running s\bsu\bud\bdo\bo with the -\b-v\bv option, a user can update
        minutes unless overridden in _\bs_\bu_\bd_\bo_\be_\br_\bs).
 
        When invoked as s\bsu\bud\bdo\boe\bed\bdi\bit\bt, the -\b-e\be option (described below), is implied.
 
        s\bsu\bud\bdo\bo determines who is an authorized user by consulting the file
        _\b/_\be_\bt_\bc_\b/_\bs_\bu_\bd_\bo_\be_\br_\bs.  By running s\bsu\bud\bdo\bo with the -\b-v\bv option, a user can update

-       the time stamp without running a _\bc_\bo_\bm_\bm_\ba_\bn_\bd. The password prompt itself
-       will also time out if the user's password is not entered within 5
-       minutes (unless overridden via _\bs_\bu_\bd_\bo_\be_\br_\bs).
+       the time stamp without running a _\bc_\bo_\bm_\bm_\ba_\bn_\bd.  If a password is required,
+       s\bsu\bud\bdo\bo will exit if the user's password is not entered within a
+       configurable time limit.  The default password prompt timeout is 5
+       minutes.

 
        If a user who is not listed in the _\bs_\bu_\bd_\bo_\be_\br_\bs file tries to run a command
        via s\bsu\bud\bdo\bo, mail is sent to the proper authorities, as defined at
 
        If a user who is not listed in the _\bs_\bu_\bd_\bo_\be_\br_\bs file tries to run a command
        via s\bsu\bud\bdo\bo, mail is sent to the proper authorities, as defined at


@@ -55,13 +58,10 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
        be used by a user to log commands through sudo even when a root shell
        has been invoked.  It also allows the -\b-e\be option to remain useful even
        when being run via a sudo-run script or program.  Note however, that
        be used by a user to log commands through sudo even when a root shell
        has been invoked.  It also allows the -\b-e\be option to remain useful even
        when being run via a sudo-run script or program.  Note however, that

-       the sudoers lookup is still done for root, not the user specified by
-       SUDO_USER.
-

 
 
 
 
 
 

-1.7.2p2                 November 24, 2009                       1
+1.7.4                     July 19, 2010                         1

 
 
 
 
 
 


@@ -70,6 +70,9 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 

+       the sudoers lookup is still done for root, not the user specified by
+       SUDO_USER.
+

        s\bsu\bud\bdo\bo can log both successful and unsuccessful attempts (as well as
        errors) to _\bs_\by_\bs_\bl_\bo_\bg(3), a log file, or both.  By default s\bsu\bud\bdo\bo will log
        via _\bs_\by_\bs_\bl_\bo_\bg(3) but this is changeable at configure time or via the
        s\bsu\bud\bdo\bo can log both successful and unsuccessful attempts (as well as
        errors) to _\bs_\by_\bs_\bl_\bo_\bg(3), a log file, or both.  By default s\bsu\bud\bdo\bo will log
        via _\bs_\by_\bs_\bl_\bo_\bg(3) but this is changeable at configure time or via the


@@ -121,13 +124,10 @@ O\bOP\bPT\bTI\bIO\bON\bNS\bS
                    with BSD login classes.
 
        -E          The -\b-E\bE (_\bp_\br_\be_\bs_\be_\br_\bv_\be _\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt) option will override the
                    with BSD login classes.
 
        -E          The -\b-E\bE (_\bp_\br_\be_\bs_\be_\br_\bv_\be _\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt) option will override the

-                   _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt option in _\bs_\bu_\bd_\bo_\be_\br_\bs(4)).  It is only available when
-                   either the matching command has the SETENV tag or the
-                   _\bs_\be_\bt_\be_\bn_\bv option is set in _\bs_\bu_\bd_\bo_\be_\br_\bs(4).

 
 
 
 
 
 

-1.7.2p2                 November 24, 2009                       2
+1.7.4                     July 19, 2010                         2

 
 
 
 
 
 


@@ -136,6 +136,10 @@ O\bOP\bPT\bTI\bIO\bON\bNS\bS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 

+                   _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt option in _\bs_\bu_\bd_\bo_\be_\br_\bs(4)).  It is only available when
+                   either the matching command has the SETENV tag or the
+                   _\bs_\be_\bt_\be_\bn_\bv option is set in _\bs_\bu_\bd_\bo_\be_\br_\bs(4).
+

        -e          The -\b-e\be (_\be_\bd_\bi_\bt) option indicates that, instead of running a
                    command, the user wishes to edit one or more files.  In
                    lieu of a command, the string "sudoedit" is used when
        -e          The -\b-e\be (_\be_\bd_\bi_\bt) option indicates that, instead of running a
                    command, the user wishes to edit one or more files.  In
                    lieu of a command, the string "sudoedit" is used when


@@ -175,25 +179,21 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        -H          The -\b-H\bH (_\bH_\bO_\bM_\bE) option sets the HOME environment variable to
                    the homedir of the target user (root by default) as
 
        -H          The -\b-H\bH (_\bH_\bO_\bM_\bE) option sets the HOME environment variable to
                    the homedir of the target user (root by default) as

-                   specified in _\bp_\ba_\bs_\bs_\bw_\bd(4).  By default, s\bsu\bud\bdo\bo does not modify
-                   HOME (see _\bs_\be_\bt_\b__\bh_\bo_\bm_\be and _\ba_\bl_\bw_\ba_\by_\bs_\b__\bs_\be_\bt_\b__\bh_\bo_\bm_\be in _\bs_\bu_\bd_\bo_\be_\br_\bs(4)).
+                   specified in _\bp_\ba_\bs_\bs_\bw_\bd(4).  The default handling of the HOME
+                   environment variable depends on _\bs_\bu_\bd_\bo_\be_\br_\bs(4) settings.  By
+                   default, s\bsu\bud\bdo\bo will set HOME if _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt or _\ba_\bl_\bw_\ba_\by_\bs_\b__\bs_\be_\bt_\b__\bh_\bo_\bm_\be
+                   are set, or if _\bs_\be_\bt_\b__\bh_\bo_\bm_\be is set and the -\b-s\bs option is
+                   specified on the command line.

 
        -h          The -\b-h\bh (_\bh_\be_\bl_\bp) option causes s\bsu\bud\bdo\bo to print a usage message
                    and exit.
 
        -i [command]
                    The -\b-i\bi (_\bs_\bi_\bm_\bu_\bl_\ba_\bt_\be _\bi_\bn_\bi_\bt_\bi_\ba_\bl _\bl_\bo_\bg_\bi_\bn) option runs the shell
 
        -h          The -\b-h\bh (_\bh_\be_\bl_\bp) option causes s\bsu\bud\bdo\bo to print a usage message
                    and exit.
 
        -i [command]
                    The -\b-i\bi (_\bs_\bi_\bm_\bu_\bl_\ba_\bt_\be _\bi_\bn_\bi_\bt_\bi_\ba_\bl _\bl_\bo_\bg_\bi_\bn) option runs the shell

-                   specified in the _\bp_\ba_\bs_\bs_\bw_\bd(4) entry of the target user as a
-                   login shell.  This means that login-specific resource files
-                   such as .profile or .login will be read by the shell.  If a
-                   command is specified, it is passed to the shell for
-                   execution.  Otherwise, an interactive shell is executed.
-                   s\bsu\bud\bdo\bo attempts to change to that user's home directory
-                   before running the shell.  It also initializes the

 
 
 
 
 
 

-1.7.2p2                 November 24, 2009                       3
+1.7.4                     July 19, 2010                         3

 
 
 
 
 
 


@@ -202,18 +202,25 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 

+                   specified in the _\bp_\ba_\bs_\bs_\bw_\bd(4) entry of the target user as a
+                   login shell.  This means that login-specific resource files
+                   such as .profile or .login will be read by the shell.  If a
+                   command is specified, it is passed to the shell for
+                   execution.  Otherwise, an interactive shell is executed.
+                   s\bsu\bud\bdo\bo attempts to change to that user's home directory
+                   before running the shell.  It also initializes the

                    environment, leaving _\bD_\bI_\bS_\bP_\bL_\bA_\bY and _\bT_\bE_\bR_\bM unchanged, setting
                    environment, leaving _\bD_\bI_\bS_\bP_\bL_\bA_\bY and _\bT_\bE_\bR_\bM unchanged, setting

-                   _\bH_\bO_\bM_\bE, _\bS_\bH_\bE_\bL_\bL, _\bU_\bS_\bE_\bR, _\bL_\bO_\bG_\bN_\bA_\bM_\bE, and _\bP_\bA_\bT_\bH, as well as the
+                   _\bH_\bO_\bM_\bE, _\bM_\bA_\bI_\bL, _\bS_\bH_\bE_\bL_\bL, _\bU_\bS_\bE_\bR, _\bL_\bO_\bG_\bN_\bA_\bM_\bE, and _\bP_\bA_\bT_\bH, as well as the

                    contents of _\b/_\be_\bt_\bc_\b/_\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt on Linux and AIX systems.  All
                    other environment variables are removed.
 
        -K          The -\b-K\bK (sure _\bk_\bi_\bl_\bl) option is like -\b-k\bk except that it removes
                    contents of _\b/_\be_\bt_\bc_\b/_\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt on Linux and AIX systems.  All
                    other environment variables are removed.
 
        -K          The -\b-K\bK (sure _\bk_\bi_\bl_\bl) option is like -\b-k\bk except that it removes

-                   the user's timestamp entirely and may not be used in
+                   the user's time stamp entirely and may not be used in

                    conjunction with a command or other option.  This option
                    does not require a password.
 
        -k          When used by itself, the -\b-k\bk (_\bk_\bi_\bl_\bl) option to s\bsu\bud\bdo\bo
                    conjunction with a command or other option.  This option
                    does not require a password.
 
        -k          When used by itself, the -\b-k\bk (_\bk_\bi_\bl_\bl) option to s\bsu\bud\bdo\bo

-                   invalidates the user's timestamp by setting the time on it
+                   invalidates the user's time stamp by setting the time on it

                    to the Epoch.  The next time s\bsu\bud\bdo\bo is run a password will be
                    required.  This option does not require a password and was
                    added to allow a user to revoke s\bsu\bud\bdo\bo permissions from a
                    to the Epoch.  The next time s\bsu\bud\bdo\bo is run a password will be
                    required.  This option does not require a password and was
                    added to allow a user to revoke s\bsu\bud\bdo\bo permissions from a


@@ -221,14 +228,14 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
                    When used in conjunction with a command or an option that
                    may require a password, the -\b-k\bk option will cause s\bsu\bud\bdo\bo to
 
                    When used in conjunction with a command or an option that
                    may require a password, the -\b-k\bk option will cause s\bsu\bud\bdo\bo to

-                   ignore the user's timestamp file.  As a result, s\bsu\bud\bdo\bo will
+                   ignore the user's time stamp file.  As a result, s\bsu\bud\bdo\bo will

                    prompt for a password (if one is required by _\bs_\bu_\bd_\bo_\be_\br_\bs) and
                    prompt for a password (if one is required by _\bs_\bu_\bd_\bo_\be_\br_\bs) and

-                   will not update the user's timestamp file.
+                   will not update the user's time stamp file.

 
 

-       -L          The -\b-L\bL (_\bl_\bi_\bs_\bt defaults) option will list out the parameters
-                   that may be set in a _\bD_\be_\bf_\ba_\bu_\bl_\bt_\bs line along with a short
-                   description for each.  This option is useful in conjunction
-                   with _\bg_\br_\be_\bp(1).
+       -L          The -\b-L\bL (_\bl_\bi_\bs_\bt defaults) option will list the parameters that
+                   may be set in a _\bD_\be_\bf_\ba_\bu_\bl_\bt_\bs line along with a short
+                   description for each.  This option will be removed from a
+                   future version of s\bsu\bud\bdo\bo.

 
        -l[l] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]
                    If no _\bc_\bo_\bm_\bm_\ba_\bn_\bd is specified, the -\b-l\bl (_\bl_\bi_\bs_\bt) option will list
 
        -l[l] [_\bc_\bo_\bm_\bm_\ba_\bn_\bd]
                    If no _\bc_\bo_\bm_\bm_\ba_\bn_\bd is specified, the -\b-l\bl (_\bl_\bi_\bs_\bt) option will list


@@ -249,17 +256,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        -P          The -\b-P\bP (_\bp_\br_\be_\bs_\be_\br_\bv_\be _\bg_\br_\bo_\bu_\bp _\bv_\be_\bc_\bt_\bo_\br) option causes s\bsu\bud\bdo\bo to
                    preserve the invoking user's group vector unaltered.  By
 
        -P          The -\b-P\bP (_\bp_\br_\be_\bs_\be_\br_\bv_\be _\bg_\br_\bo_\bu_\bp _\bv_\be_\bc_\bt_\bo_\br) option causes s\bsu\bud\bdo\bo to
                    preserve the invoking user's group vector unaltered.  By

-                   default, s\bsu\bud\bdo\bo will initialize the group vector to the list
-                   of groups the target user is in.  The real and effective
-                   group IDs, however, are still set to match the target user.

 
 

-       -p _\bp_\br_\bo_\bm_\bp_\bt   The -\b-p\bp (_\bp_\br_\bo_\bm_\bp_\bt) option allows you to override the default
-                   password prompt and use a custom one.  The following
-                   percent (`%') escapes are supported:

 
 
 
 

-
-1.7.2p2                 November 24, 2009                       4
+1.7.4                     July 19, 2010                         4

 
 
 
 
 
 


@@ -268,11 +268,19 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 

-                   %H  expanded to the local hostname including the domain
-                       name (on if the machine's hostname is fully qualified
+                   default, s\bsu\bud\bdo\bo will initialize the group vector to the list
+                   of groups the target user is in.  The real and effective
+                   group IDs, however, are still set to match the target user.
+
+       -p _\bp_\br_\bo_\bm_\bp_\bt   The -\b-p\bp (_\bp_\br_\bo_\bm_\bp_\bt) option allows you to override the default
+                   password prompt and use a custom one.  The following
+                   percent (`%') escapes are supported:
+
+                   %H  expanded to the local host name including the domain
+                       name (on if the machine's host name is fully qualified

                        or the _\bf_\bq_\bd_\bn _\bs_\bu_\bd_\bo_\be_\br_\bs option is set)
 
                        or the _\bf_\bq_\bd_\bn _\bs_\bu_\bd_\bo_\be_\br_\bs option is set)
 

-                   %h  expanded to the local hostname without the domain name
+                   %h  expanded to the local host name without the domain name

 
                    %p  expanded to the user whose password is being asked for
                        (respects the _\br_\bo_\bo_\bt_\bp_\bw, _\bt_\ba_\br_\bg_\be_\bt_\bp_\bw and _\br_\bu_\bn_\ba_\bs_\bp_\bw flags in
 
                    %p  expanded to the user whose password is being asked for
                        (respects the _\br_\bo_\bo_\bt_\bp_\bw, _\bt_\ba_\br_\bg_\be_\bt_\bp_\bw and _\br_\bu_\bn_\ba_\bs_\bp_\bw flags in


@@ -290,6 +298,9 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    system password prompt on systems that support PAM unless
                    the _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt_\b__\bo_\bv_\be_\br_\br_\bi_\bd_\be flag is disabled in _\bs_\bu_\bd_\bo_\be_\br_\bs.
 
                    system password prompt on systems that support PAM unless
                    the _\bp_\ba_\bs_\bs_\bp_\br_\bo_\bm_\bp_\bt_\b__\bo_\bv_\be_\br_\br_\bi_\bd_\be flag is disabled in _\bs_\bu_\bd_\bo_\be_\br_\bs.
 

+       -r _\br_\bo_\bl_\be     The -\b-r\br (_\br_\bo_\bl_\be) option causes the new (SELinux) security
+                   context to have the role specified by _\br_\bo_\bl_\be.
+

        -S          The -\b-S\bS (_\bs_\bt_\bd_\bi_\bn) option causes s\bsu\bud\bdo\bo to read the password from
                    the standard input instead of the terminal device.  The
                    password must be followed by a newline character.
        -S          The -\b-S\bS (_\bs_\bt_\bd_\bi_\bn) option causes s\bsu\bud\bdo\bo to read the password from
                    the standard input instead of the terminal device.  The
                    password must be followed by a newline character.


@@ -301,11 +312,28 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    the shell for execution.  Otherwise, an interactive shell
                    is executed.
 
                    the shell for execution.  Otherwise, an interactive shell
                    is executed.
 

+       -t _\bt_\by_\bp_\be     The -\b-t\bt (_\bt_\by_\bp_\be) option causes the new (SELinux) security
+                   context to have the type specified by _\bt_\by_\bp_\be.  If no type is
+                   specified, the default type is derived from the specified
+                   role.
+

        -U _\bu_\bs_\be_\br     The -\b-U\bU (_\bo_\bt_\bh_\be_\br _\bu_\bs_\be_\br) option is used in conjunction with the
                    -\b-l\bl option to specify the user whose privileges should be
                    listed.  Only root or a user with s\bsu\bud\bdo\bo ALL on the current
                    host may use this option.
 
        -U _\bu_\bs_\be_\br     The -\b-U\bU (_\bo_\bt_\bh_\be_\br _\bu_\bs_\be_\br) option is used in conjunction with the
                    -\b-l\bl option to specify the user whose privileges should be
                    listed.  Only root or a user with s\bsu\bud\bdo\bo ALL on the current
                    host may use this option.
 

+
+
+
+1.7.4                     July 19, 2010                         5
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+

        -u _\bu_\bs_\be_\br     The -\b-u\bu (_\bu_\bs_\be_\br) option causes s\bsu\bud\bdo\bo to run the specified
                    command as a user other than _\br_\bo_\bo_\bt.  To specify a _\bu_\bi_\bd
                    instead of a _\bu_\bs_\be_\br _\bn_\ba_\bm_\be, use _\b#_\bu_\bi_\bd.  When running commands as
        -u _\bu_\bs_\be_\br     The -\b-u\bu (_\bu_\bs_\be_\br) option causes s\bsu\bud\bdo\bo to run the specified
                    command as a user other than _\br_\bo_\bo_\bt.  To specify a _\bu_\bi_\bd
                    instead of a _\bu_\bs_\be_\br _\bn_\ba_\bm_\be, use _\b#_\bu_\bi_\bd.  When running commands as


@@ -321,26 +349,13 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    addresses.
 
        -v          If given the -\b-v\bv (_\bv_\ba_\bl_\bi_\bd_\ba_\bt_\be) option, s\bsu\bud\bdo\bo will update the
                    addresses.
 
        -v          If given the -\b-v\bv (_\bv_\ba_\bl_\bi_\bd_\ba_\bt_\be) option, s\bsu\bud\bdo\bo will update the

-                   user's timestamp, prompting for the user's password if
-
-
-
-1.7.2p2                 November 24, 2009                       5
-
-
-
-
-
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-
+                   user's time stamp, prompting for the user's password if

                    necessary.  This extends the s\bsu\bud\bdo\bo timeout for another 5
                    minutes (or whatever the timeout is set to in _\bs_\bu_\bd_\bo_\be_\br_\bs) but
                    does not run a command.
 
        --          The -\b--\b- option indicates that s\bsu\bud\bdo\bo should stop processing
                    necessary.  This extends the s\bsu\bud\bdo\bo timeout for another 5
                    minutes (or whatever the timeout is set to in _\bs_\bu_\bd_\bo_\be_\br_\bs) but
                    does not run a command.
 
        --          The -\b--\b- option indicates that s\bsu\bud\bdo\bo should stop processing

-                   command line arguments.  It is most useful in conjunction
-                   with the -\b-s\bs option.
+                   command line arguments.

 
        Environment variables to be set for the command may also be passed on
        the command line in the form of V\bVA\bAR\bR=_\bv_\ba_\bl_\bu_\be, e.g.
 
        Environment variables to be set for the command may also be passed on
        the command line in the form of V\bVA\bAR\bR=_\bv_\ba_\bl_\bu_\be, e.g.


@@ -373,6 +388,18 @@ S\bSE\bEC\bCU\bUR\bRI\bIT\bTY\bY N\bNO\bOT\bTE\bES\bS
        default, the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt _\bs_\bu_\bd_\bo_\be_\br_\bs option is enabled.  This causes commands
        to be executed with a minimal environment containing TERM, PATH, HOME,
        SHELL, LOGNAME, USER and USERNAME in addition to variables from the
        default, the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt _\bs_\bu_\bd_\bo_\be_\br_\bs option is enabled.  This causes commands
        to be executed with a minimal environment containing TERM, PATH, HOME,
        SHELL, LOGNAME, USER and USERNAME in addition to variables from the

+
+
+
+1.7.4                     July 19, 2010                         6
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+

        invoking process permitted by the _\be_\bn_\bv_\b__\bc_\bh_\be_\bc_\bk and _\be_\bn_\bv_\b__\bk_\be_\be_\bp _\bs_\bu_\bd_\bo_\be_\br_\bs
        options.  There is effectively a whitelist for environment variables.
 
        invoking process permitted by the _\be_\bn_\bv_\b__\bc_\bh_\be_\bc_\bk and _\be_\bn_\bv_\b__\bk_\be_\be_\bp _\bs_\bu_\bd_\bo_\be_\br_\bs
        options.  There is effectively a whitelist for environment variables.
 


@@ -388,18 +415,6 @@ S\bSE\bEC\bCU\bUR\bRI\bIT\bTY\bY N\bNO\bOT\bTE\bES\bS
        environment variables that s\bsu\bud\bdo\bo allows or denies is contained in the
        output of sudo -V when run as root.
 
        environment variables that s\bsu\bud\bdo\bo allows or denies is contained in the
        output of sudo -V when run as root.
 

-
-
-
-1.7.2p2                 November 24, 2009                       6
-
-
-
-
-
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-

        Note that the dynamic linker on most operating systems will remove
        variables that can control dynamic linking from the environment of
        setuid executables, including s\bsu\bud\bdo\bo.  Depending on the operating system
        Note that the dynamic linker on most operating systems will remove
        variables that can control dynamic linking from the environment of
        setuid executables, including s\bsu\bud\bdo\bo.  Depending on the operating system


@@ -414,28 +429,58 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
        environment variable is _\bn_\bo_\bt modified and is passed unchanged to the
        program that s\bsu\bud\bdo\bo executes.
 
        environment variable is _\bn_\bo_\bt modified and is passed unchanged to the
        program that s\bsu\bud\bdo\bo executes.
 

-       s\bsu\bud\bdo\bo will check the ownership of its timestamp directory (_\b/_\bv_\ba_\br_\b/_\br_\bu_\bn_\b/_\bs_\bu_\bd_\bo
-       by default) and ignore the directory's contents if it is not owned by
-       root or if it is writable by a user other than root.  On systems that
-       allow non-root users to give away files via _\bc_\bh_\bo_\bw_\bn(2), if the timestamp
-       directory is located in a directory writable by anyone (e.g., _\b/_\bt_\bm_\bp), it
-       is possible for a user to create the timestamp directory before s\bsu\bud\bdo\bo is
-       run.  However, because s\bsu\bud\bdo\bo checks the ownership and mode of the
-       directory and its contents, the only damage that can be done is to
-       "hide" files by putting them in the timestamp dir.  This is unlikely to
-       happen since once the timestamp dir is owned by root and inaccessible
-       by any other user, the user placing files there would be unable to get
-       them back out.  To get around this issue you can use a directory that
-       is not world-writable for the timestamps (_\b/_\bv_\ba_\br_\b/_\ba_\bd_\bm_\b/_\bs_\bu_\bd_\bo for instance)
-       or create _\b/_\bv_\ba_\br_\b/_\br_\bu_\bn_\b/_\bs_\bu_\bd_\bo with the appropriate owner (root) and
-       permissions (0700) in the system startup files.
-
-       s\bsu\bud\bdo\bo will not honor timestamps set far in the future.  Timestamps with
+       s\bsu\bud\bdo\bo will check the ownership of its time stamp directory
+       (_\b/_\bv_\ba_\br_\b/_\ba_\bd_\bm_\b/_\bs_\bu_\bd_\bo by default) and ignore the directory's contents if it is
+       not owned by root or if it is writable by a user other than root.  On
+       systems that allow non-root users to give away files via _\bc_\bh_\bo_\bw_\bn(2), if
+       the time stamp directory is located in a directory writable by anyone
+       (e.g., _\b/_\bt_\bm_\bp), it is possible for a user to create the time stamp
+       directory before s\bsu\bud\bdo\bo is run.  However, because s\bsu\bud\bdo\bo checks the
+       ownership and mode of the directory and its contents, the only damage
+       that can be done is to "hide" files by putting them in the time stamp
+       dir.  This is unlikely to happen since once the time stamp dir is owned
+       by root and inaccessible by any other user, the user placing files
+       there would be unable to get them back out.  To get around this issue
+       you can use a directory that is not world-writable for the time stamps
+       (_\b/_\bv_\ba_\br_\b/_\ba_\bd_\bm_\b/_\bs_\bu_\bd_\bo for instance) or create _\b/_\bv_\ba_\br_\b/_\ba_\bd_\bm_\b/_\bs_\bu_\bd_\bo with the
+       appropriate owner (root) and permissions (0700) in the system startup
+       files.
+
+       s\bsu\bud\bdo\bo will not honor time stamps set far in the future.  Timestamps with

        a date greater than current_time + 2 * TIMEOUT will be ignored and sudo
        will log and complain.  This is done to keep a user from creating
        a date greater than current_time + 2 * TIMEOUT will be ignored and sudo
        will log and complain.  This is done to keep a user from creating

-       his/her own timestamp with a bogus date on systems that allow users to
+       his/her own time stamp with a bogus date on systems that allow users to

        give away files.
 
        give away files.
 

+       On systems where the boot time is available, s\bsu\bud\bdo\bo will also not honor
+       time stamps from before the machine booted.
+
+
+
+1.7.4                     July 19, 2010                         7
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+
+       Since time stamp files live in the file system, they can outlive a
+       user's login session.  As a result, a user may be able to login, run a
+       command with s\bsu\bud\bdo\bo after authenticating, logout, login again, and run
+       s\bsu\bud\bdo\bo without authenticating so long as the time stamp file's
+       modification time is within 5 minutes (or whatever the timeout is set
+       to in _\bs_\bu_\bd_\bo_\be_\br_\bs).  When the _\bt_\bt_\by_\b__\bt_\bi_\bc_\bk_\be_\bt_\bs option is enabled in _\bs_\bu_\bd_\bo_\be_\br_\bs, the
+       time stamp has per-tty granularity but still may outlive the user's
+       session.  On Linux systems where the devpts filesystem is used, Solaris
+       systems with the devices filesystem, as well as other systems that
+       utilize a devfs filesystem that monotonically increase the inode number
+       of devices as they are created (such as Mac OS X), s\bsu\bud\bdo\bo is able to
+       determine when a tty-based time stamp file is stale and will ignore it.
+       Administrators should not rely on this feature as it is not universally
+       available.
+

        Please note that s\bsu\bud\bdo\bo will normally only log the command it explicitly
        runs.  If a user runs a command such as sudo su or sudo sh, subsequent
        commands run from that shell will _\bn_\bo_\bt be logged, nor will s\bsu\bud\bdo\bo's access
        Please note that s\bsu\bud\bdo\bo will normally only log the command it explicitly
        runs.  If a user runs a command such as sudo su or sudo sh, subsequent
        commands run from that shell will _\bn_\bo_\bt be logged, nor will s\bsu\bud\bdo\bo's access


@@ -452,21 +497,13 @@ E\bEN\bNV\bVI\bIR\bRO\bON\bNM\bME\bEN\bNT\bT
        EDITOR          Default editor to use in -\b-e\be (sudoedit) mode if neither
                        SUDO_EDITOR nor VISUAL is set
 
        EDITOR          Default editor to use in -\b-e\be (sudoedit) mode if neither
                        SUDO_EDITOR nor VISUAL is set
 

-       HOME            In -\b-s\bs or -\b-H\bH mode (or if sudo was configured with the
-                       --enable-shell-sets-home option), set to homedir of the
-
-
-
-1.7.2p2                 November 24, 2009                       7
-
-
-
-
+       MAIL            In -\b-i\bi mode or when _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt is enabled in _\bs_\bu_\bd_\bo_\be_\br_\bs, set
+                       to the mail spool of the target user

 
 

-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-
-                       target user
+       HOME            Set to the home directory of the target user if -\b-i\bi or
+                       -\b-H\bH are specified, _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt or _\ba_\bl_\bw_\ba_\by_\bs_\b__\bs_\be_\bt_\b__\bh_\bo_\bm_\be are set
+                       in _\bs_\bu_\bd_\bo_\be_\br_\bs, or when the -\b-s\bs option is specified and
+                       _\bs_\be_\bt_\b__\bh_\bo_\bm_\be is set in _\bs_\bu_\bd_\bo_\be_\br_\bs

 
        PATH            Set to a sane value if the _\bs_\be_\bc_\bu_\br_\be_\b__\bp_\ba_\bt_\bh sudoers option
                        is set.
 
        PATH            Set to a sane value if the _\bs_\be_\bc_\bu_\br_\be_\b__\bp_\ba_\bt_\bh sudoers option
                        is set.


@@ -483,6 +520,18 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        SUDO_GID        Set to the group ID of the user who invoked sudo
 
 
        SUDO_GID        Set to the group ID of the user who invoked sudo
 

+
+
+
+1.7.4                     July 19, 2010                         8
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+

        SUDO_PROMPT     Used as the default password prompt
 
        SUDO_PS1        If set, PS1 will be set to its value for the program
        SUDO_PROMPT     Used as the default password prompt
 
        SUDO_PS1        If set, PS1 will be set to its value for the program


@@ -501,7 +550,7 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 F\bFI\bIL\bLE\bES\bS
        _\b/_\be_\bt_\bc_\b/_\bs_\bu_\bd_\bo_\be_\br_\bs            List of who can run what
 
 F\bFI\bIL\bLE\bES\bS
        _\b/_\be_\bt_\bc_\b/_\bs_\bu_\bd_\bo_\be_\br_\bs            List of who can run what
 

-       _\b/_\bv_\ba_\br_\b/_\br_\bu_\bn_\b/_\bs_\bu_\bd_\bo           Directory containing timestamps
+       _\b/_\bv_\ba_\br_\b/_\ba_\bd_\bm_\b/_\bs_\bu_\bd_\bo           Directory containing time stamps

 
        _\b/_\be_\bt_\bc_\b/_\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt        Initial environment for -\b-i\bi mode on Linux and
                                AIX
 
        _\b/_\be_\bt_\bc_\b/_\be_\bn_\bv_\bi_\br_\bo_\bn_\bm_\be_\bn_\bt        Initial environment for -\b-i\bi mode on Linux and
                                AIX


@@ -520,18 +569,6 @@ E\bEX\bXA\bAM\bMP\bPL\bLE\bES\bS
 
        To edit the _\bi_\bn_\bd_\be_\bx_\b._\bh_\bt_\bm_\bl file as user www:
 
 
        To edit the _\bi_\bn_\bd_\be_\bx_\b._\bh_\bt_\bm_\bl file as user www:
 

-
-
-
-1.7.2p2                 November 24, 2009                       8
-
-
-
-
-
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-

         $ sudo -u www vi ~www/htdocs/index.html
 
        To view system logs only accessible to root and users in the adm group:
         $ sudo -u www vi ~www/htdocs/index.html
 
        To view system logs only accessible to root and users in the adm group:


@@ -550,6 +587,17 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
        Note that this runs the commands in a sub-shell to make the cd and file
        redirection work.
 
        Note that this runs the commands in a sub-shell to make the cd and file
        redirection work.
 

+
+
+1.7.4                     July 19, 2010                         9
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+

         $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
 
 S\bSE\bEE\bE A\bAL\bLS\bSO\bO
         $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
 
 S\bSE\bEE\bE A\bAL\bLS\bSO\bO


@@ -586,18 +634,6 @@ C\bCA\bAV\bVE\bEA\bAT\bTS\bS
 
        Running shell scripts via s\bsu\bud\bdo\bo can expose the same kernel bugs that
        make setuid shell scripts unsafe on some operating systems (if your OS
 
        Running shell scripts via s\bsu\bud\bdo\bo can expose the same kernel bugs that
        make setuid shell scripts unsafe on some operating systems (if your OS

-
-
-
-1.7.2p2                 November 24, 2009                       9
-
-
-
-
-
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-

        has a /dev/fd/ directory, setuid shell scripts are generally safe).
 
 B\bBU\bUG\bGS\bS
        has a /dev/fd/ directory, setuid shell scripts are generally safe).
 
 B\bBU\bUG\bGS\bS


@@ -619,42 +655,6 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
 
 
 
 
 
 

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-1.7.2p2                 November 24, 2009                      10
+1.7.4                     July 19, 2010                        10