Imported Upstream version 1.7.2p7

[debian/sudo] / sudoers.pod

diff --git a/sudoers.pod b/sudoers.pod
index d8af57fd58ea6cae963eff52df526292f18740f7..4cf77aaea528af7d57c9f28d21fdc2bd671706fd 100644 (file)
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -1,5 +1,4 @@
-=cut
-Copyright (c) 1994-1996, 1998-2005, 2007
+Copyright (c) 1994-1996, 1998-2005, 2007-2010

        Todd C. Miller <Todd.Miller@courtesan.com>
 
 Permission to use, copy, modify, and distribute this software for any
        Todd C. Miller <Todd.Miller@courtesan.com>
 
 Permission to use, copy, modify, and distribute this software for any


@@ -19,7 +18,6 @@ Sponsored in part by the Defense Advanced Research Projects
 Agency (DARPA) and Air Force Research Laboratory, Air Force
 Materiel Command, USAF, under agreement number F39502-99-1-0512.
 
 Agency (DARPA) and Air Force Research Laboratory, Air Force
 Materiel Command, USAF, under agreement number F39502-99-1-0512.
 

-$Sudo: sudoers.pod,v 1.95.2.22 2007/12/02 17:13:52 millert Exp $

 =pod
 
 =head1 NAME
 =pod
 
 =head1 NAME


@@ -114,32 +112,60 @@ The definitions of what constitutes a valid I<alias> member follow.
               User ',' User_List
 
  User ::= '!'* username |
               User ',' User_List
 
  User ::= '!'* username |

+         '!'* '#'uid |

          '!'* '%'group |
          '!'* '+'netgroup |
          '!'* '%'group |
          '!'* '+'netgroup |

+         '!'* '%:'nonunix_group |

          '!'* User_Alias
 
          '!'* User_Alias
 

-A C<User_List> is made up of one or more usernames, system groups
-(prefixed with '%'), netgroups (prefixed with '+') and other aliases.
-Each list item may be prefixed with one or more '!' operators.
-An odd number of '!' operators negate the value of the item; an even
-number just cancel each other out.
-
- Runas_List ::= Runas_User |
-               Runas_User ',' Runas_List
-
- Runas_User ::= '!'* username |
-               '!'* '#'uid |
-               '!'* '%'group |
-               '!'* +netgroup |
-               '!'* Runas_Alias
-
-A C<Runas_List> is similar to a C<User_List> except that it can
-also contain uids (prefixed with '#') and instead of C<User_Alias>es
-it can contain C<Runas_Alias>es.  Note that usernames and groups
-are matched as strings.  In other words, two users (groups) with
-the same uid (gid) are considered to be distinct.  If you wish to
-match all usernames with the same uid (e.g.E<nbsp>root and toor), you
-can use a uid instead (#0 in the example given).
+A C<User_List> is made up of one or more usernames, uids (prefixed
+with '#'), system groups (prefixed with '%'), netgroups (prefixed
+with '+') and C<User_Alias>es.  Each list item may be prefixed with
+zero or more '!' operators.  An odd number of '!' operators negate
+the value of the item; an even number just cancel each other out.
+
+A C<username>, C<group>, C<netgroup> and C<nonunix_groups> may
+be enclosed in double quotes to avoid the need for escaping special
+characters.  Alternately, special characters may be specified in
+escaped hex mode, e.g. \x20 for space.
+
+The C<nonunix_group> syntax depends on the underlying implementation.
+For instance, the QAS AD backend supports the following formats:
+
+=over 4
+
+=item *
+
+Group in the same domain: "Group Name"
+
+=item *
+
+Group in any domain: "Group Name@FULLY.QUALIFIED.DOMAIN"
+
+=item *
+
+Group SID: "S-1-2-34-5678901234-5678901234-5678901234-567"
+
+=back
+
+Note that quotes around group names are optional.  Unquoted strings must
+use a backslash (\) to escape spaces and the '@' symbol.
+
+ Runas_List ::= Runas_Member |
+               Runas_Member ',' Runas_List
+
+ Runas_Member ::= '!'* username |
+                 '!'* '#'uid |
+                 '!'* '%'group |
+                 '!'* +netgroup |
+                 '!'* Runas_Alias
+
+A C<Runas_List> is similar to a C<User_List> except that instead
+of C<User_Alias>es it can contain C<Runas_Alias>es.  Note that
+usernames and groups are matched as strings.  In other words, two
+users (groups) with the same uid (gid) are considered to be distinct.
+If you wish to match all usernames with the same uid (e.g.E<nbsp>root
+and toor), you can use a uid instead (#0 in the example given).

 
  Host_List ::= Host |
               Host ',' Host_List
 
  Host_List ::= Host |
               Host ',' Host_List


@@ -193,7 +219,7 @@ in the C<Cmnd> must match exactly those given by the user on the command line
 (or match the wildcards if there are any).  Note that the following
 characters must be escaped with a '\' if they are used in command
 arguments: ',', ':', '=', '\'.  The special command C<"sudoedit">
 (or match the wildcards if there are any).  Note that the following
 characters must be escaped with a '\' if they are used in command
 arguments: ',', ':', '=', '\'.  The special command C<"sudoedit">

-is used to permit a user to run B<sudo> with the B<-e> flag (or
+is used to permit a user to run B<sudo> with the B<-e> option (or

 as B<sudoedit>).  It may take command line arguments just as
 a normal command does.
 
 as B<sudoedit>).  It may take command line arguments just as
 a normal command does.
 


@@ -202,11 +228,15 @@ a normal command does.
 Certain configuration options may be changed from their default
 values at runtime via one or more C<Default_Entry> lines.  These
 may affect all users on any host, all users on a specific host, a
 Certain configuration options may be changed from their default
 values at runtime via one or more C<Default_Entry> lines.  These
 may affect all users on any host, all users on a specific host, a

-specific user, or commands being run as a specific user.
+specific user, a specific command, or commands being run as a specific user.
+Note that per-command entries may not include command line arguments.
+If you need to specify arguments, define a C<Cmnd_Alias> and reference
+that instead.

 
  Default_Type ::= 'Defaults' |
                  'Defaults' '@' Host_List |
                  'Defaults' ':' User_List |
 
  Default_Type ::= 'Defaults' |
                  'Defaults' '@' Host_List |
                  'Defaults' ':' User_List |

+                 'Defaults' '!' Cmnd_List |

                  'Defaults' '>' Runas_List
 
  Default_Entry ::= Default_Type Parameter_List
                  'Defaults' '>' Runas_List
 
  Default_Entry ::= Default_Type Parameter_List


@@ -231,7 +261,11 @@ These operators are used to add to and delete from a list respectively.
 It is not an error to use the C<-=> operator to remove an element
 that does not exist in a list.
 
 It is not an error to use the C<-=> operator to remove an element
 that does not exist in a list.
 

-See L</"SUDOERS OPTIONS"> for a list of supported Defaults parameters.
+Defaults entries are parsed in the following order: generic, host
+and user Defaults first, then runas Defaults and finally command
+defaults.
+
+See L<"SUDOERS OPTIONS"> for a list of supported Defaults parameters.

 
 =head2 User Specification
 
 
 =head2 User Specification
 


@@ -243,24 +277,38 @@ See L</"SUDOERS OPTIONS"> for a list of supported Defaults parameters.
 
  Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
 
 
  Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
 

- Runas_Spec ::= '(' Runas_List ')'
+ Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

 
  Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
 
  Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |

-              'SETENV:' | 'NOSETENV:')
+              'SETENV:' | 'NOSETENV:' )

 
 A B<user specification> determines which commands a user may run
 (and as what user) on specified hosts.  By default, commands are
 run as B<root>, but this can be changed on a per-command basis.
 
 
 A B<user specification> determines which commands a user may run
 (and as what user) on specified hosts.  By default, commands are
 run as B<root>, but this can be changed on a per-command basis.
 

-Let's break that down into its constituent parts:
+The basic structure of a user specification is `who = where (as_whom)
+what'.  Let's break that down into its constituent parts:

 
 =head2 Runas_Spec
 
 
 =head2 Runas_Spec
 

-A C<Runas_Spec> is simply a C<Runas_List> (as defined above)
-enclosed in a set of parentheses.  If you do not specify a
-C<Runas_Spec> in the user specification, a default C<Runas_Spec>
-of B<root> will be used.  A C<Runas_Spec> sets the default for
-commands that follow it.  What this means is that for the entry:
+A C<Runas_Spec> determines the user and/or the group that a command
+may be run as.  A fully-specified C<Runas_Spec> consists of two
+C<Runas_List>s (as defined above) separated by a colon (':') and
+enclosed in a set of parentheses.  The first C<Runas_List> indicates
+which users the command may be run as via B<sudo>'s B<-u> option.
+The second defines a list of groups that can be specified via
+B<sudo>'s B<-g> option.  If both C<Runas_List>s are specified, the
+command may be run with any combination of users and groups listed
+in their respective C<Runas_List>s.  If only the first is specified,
+the command may be run as any user in the list but no B<-g> option
+may be specified.  If the first C<Runas_List> is empty but the
+second is specified, the command may be run as the invoking user
+with the group set to any listed in the C<Runas_List>.  If no
+C<Runas_Spec> is specified the command may be run as B<root> and
+no group may be specified.
+
+A C<Runas_Spec> sets the default for the commands that follow it.
+What this means is that for the entry:

 
  dgb   boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
 
 
  dgb   boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
 


@@ -277,10 +325,23 @@ entry.  If we modify the entry like so:
 Then user B<dgb> is now allowed to run F</bin/ls> as B<operator>,
 but  F</bin/kill> and F</usr/bin/lprm> as B<root>.
 
 Then user B<dgb> is now allowed to run F</bin/ls> as B<operator>,
 but  F</bin/kill> and F</usr/bin/lprm> as B<root>.
 

+We can extend this to allow B<dgb> to run C</bin/ls> with either
+the user or group set to B<operator>:
+
+ dgb   boulder = (operator : operator) /bin/ls, (root) /bin/kill, \
+       /usr/bin/lprm
+
+In the following example, user B<tcm> may run commands that access
+a modem device file with the dialer group.  Note that in this example
+only the group will be set, the command still runs as user B<tcm>.
+
+ tcm   boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
+       /usr/local/bin/minicom
+

 =head2 Tag_Spec
 
 A command may have zero or more tags associated with it.  There are
 =head2 Tag_Spec
 
 A command may have zero or more tags associated with it.  There are

-six possible tag values, C<NOPASSWD>, C<PASSWD>, C<NOEXEC>, C<EXEC>,
+eight possible tag values, C<NOPASSWD>, C<PASSWD>, C<NOEXEC>, C<EXEC>,

 C<SETENV> and C<NOSETENV>.
 Once a tag is set on a C<Cmnd>, subsequent C<Cmnd>s in the
 C<Cmnd_Spec_List>, inherit the tag unless it is overridden by the
 C<SETENV> and C<NOSETENV>.
 Once a tag is set on a C<Cmnd>, subsequent C<Cmnd>s in the
 C<Cmnd_Spec_List>, inherit the tag unless it is overridden by the


@@ -299,7 +360,7 @@ For example:
  ray   rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
 
 would allow the user B<ray> to run F</bin/kill>, F</bin/ls>, and
  ray   rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
 
 would allow the user B<ray> to run F</bin/kill>, F</bin/ls>, and

-F</usr/bin/lprm> as root on the machine rushmore as B<root> without
+F</usr/bin/lprm> as B<root> on the machine rushmore without

 authenticating himself.  If we only want B<ray> to be able to
 run F</bin/kill> without a password the entry would be:
 
 authenticating himself.  If we only want B<ray> to be able to
 run F</bin/kill> without a password the entry would be:
 


@@ -343,9 +404,10 @@ be overridden by use of the C<UNSETENV> tag.
 =head2 Wildcards
 
 B<sudo> allows shell-style I<wildcards> (aka meta or glob characters)
 =head2 Wildcards
 
 B<sudo> allows shell-style I<wildcards> (aka meta or glob characters)

-to be used in pathnames as well as command line arguments in the
-I<sudoers> file.  Wildcard matching is done via the B<POSIX>
-L<fnmatch(3)> routine.  Note that these are I<not> regular expressions.
+to be used in hostnames, pathnames and command line arguments in
+the I<sudoers> file.  Wildcard matching is done via the B<POSIX>
+L<glob(3)> and L<fnmatch(3)> routines.  Note that these are I<not>
+regular expressions.

 
 =over 8
 
 
 =over 8
 


@@ -372,6 +434,15 @@ escape special characters such as: "*", "?", "[", and "}".
 
 =back
 
 
 =back
 

+POSIX character classes may also be used if your system's L<glob(3)>
+and L<fnmatch(3)> functions support them.  However, because the
+C<':'> character has special meaning in I<sudoers>, it must be
+escaped.  For example:
+
+    /bin/ls [[\:alpha\:]]*
+
+Would match any filename beginning with a letter.
+

 Note that a forward slash ('/') will B<not> be matched by
 wildcards used in the pathname.  When matching the command
 line arguments, however, a slash B<does> get matched by
 Note that a forward slash ('/') will B<not> be matched by
 wildcards used in the pathname.  When matching the command
 line arguments, however, a slash B<does> get matched by


@@ -395,6 +466,61 @@ with B<any> arguments.
 
 =back
 
 
 =back
 

+=head2 Including other files from within sudoers
+
+It is possible to include other I<sudoers> files from within the
+I<sudoers> file currently being parsed using the C<#include> and
+C<#includedir> directives.
+
+This can be used, for example, to keep a site-wide I<sudoers> file
+in addition to a local, per-machine file.  For the sake of this
+example the site-wide I<sudoers> will be F</etc/sudoers> and the
+per-machine one will be F</etc/sudoers.local>.  To include
+F</etc/sudoers.local> from within F</etc/sudoers> we would use the
+following line in F</etc/sudoers>:
+
+=over 4
+
+C<#include /etc/sudoers.local>
+
+=back
+
+When B<sudo> reaches this line it will suspend processing of the
+current file (F</etc/sudoers>) and switch to F</etc/sudoers.local>.
+Upon reaching the end of F</etc/sudoers.local>, the rest of
+F</etc/sudoers> will be processed.  Files that are included may
+themselves include other files.  A hard limit of 128 nested include
+files is enforced to prevent include file loops.
+
+The filename may include the C<%h> escape, signifying the short form
+of the hostname.  I.e., if the machine's hostname is "xerxes", then
+
+C<#include /etc/sudoers.%h>
+
+will cause B<sudo> to include the file F</etc/sudoers.xerxes>.
+
+The C<#includedir> directive can be used to create a F<sudo.d>
+directory that the system package manager can drop I<sudoers> rules
+into as part of package installation.  For example, given:
+
+C<#includedir /etc/sudoers.d>
+
+B<sudo> will read each file in F</etc/sudoers.d>, skipping file
+names that end in C<~> or contain a C<.> character to avoid causing
+problems with package manager or editor temporary/backup files.
+Files are parsed in sorted lexical order.  That is,
+F</etc/sudoers.d/01_first> will be parsed before
+F</etc/sudoers.d/10_second>.  Be aware that because the sorting is
+lexical, not numeric, F</etc/sudoers.d/1_whoops> would be loaded
+B<after> F</etc/sudoers.d/10_second>.  Using a consistent number
+of leading zeroes in the file names can be used to avoid such
+problems.
+
+Note that unlike files included via C<#include>, B<visudo> will not
+edit the files in a C<#includedir> directory unless one of them
+contains a syntax error.  It is still possible to run B<visudo>
+with the C<-f> flag to edit the files directly.
+

 =head2 Other special characters and reserved words
 
 The pound sign ('#') is used to indicate a comment (unless it is
 =head2 Other special characters and reserved words
 
 The pound sign ('#') is used to indicate a comment (unless it is


@@ -442,7 +568,7 @@ B<Flags>:
 
 If set, B<sudo> will set the C<HOME> environment variable to the home
 directory of the target user (which is root unless the B<-u> option is used).
 
 If set, B<sudo> will set the C<HOME> environment variable to the home
 directory of the target user (which is root unless the B<-u> option is used).

-This effectively means that the B<-H> flag is always implied.
+This effectively means that the B<-H> option is always implied.

 This flag is I<off> by default.
 
 =item authenticate
 This flag is I<off> by default.
 
 =item authenticate


@@ -452,6 +578,12 @@ means of authentication) before they may run commands.  This default
 may be overridden via the C<PASSWD> and C<NOPASSWD> tags.
 This flag is I<on> by default.
 
 may be overridden via the C<PASSWD> and C<NOPASSWD> tags.
 This flag is I<on> by default.
 

+=item closefrom_override
+
+If set, the user may use B<sudo>'s B<-C> option which
+overrides the default starting point at which B<sudo> begins
+closing open file descriptors.  This flag is I<off> by default.
+

 =item env_editor
 
 If set, B<visudo> will use the value of the EDITOR or VISUAL
 =item env_editor
 
 If set, B<visudo> will use the value of the EDITOR or VISUAL


@@ -470,9 +602,9 @@ LOGNAME, SHELL, USER, USERNAME and the C<SUDO_*> variables.  Any
 variables in the caller's environment that match the C<env_keep>
 and C<env_check> lists are then added.  The default contents of the
 C<env_keep> and C<env_check> lists are displayed when B<sudo> is
 variables in the caller's environment that match the C<env_keep>
 and C<env_check> lists are then added.  The default contents of the
 C<env_keep> and C<env_check> lists are displayed when B<sudo> is

-run by root with the I<-V> option.  If B<sudo> was compiled with
-the C<SECURE_PATH> option, its value will be used for the C<PATH>
-environment variable.  This flag is I<on> by default.
+run by root with the I<-V> option.  If the I<secure_path> option
+is set, its value will be used for the C<PATH> environment variable.
+This flag is I<on> by default.

 
 =item fqdn
 
 
 =item fqdn
 


@@ -493,21 +625,18 @@ I<fqdn>.  This flag is I<@fqdn@> by default.
 
 If set, B<sudo> will ignore '.' or '' (current dir) in the C<PATH>
 environment variable; the C<PATH> itself is not modified.  This
 
 If set, B<sudo> will ignore '.' or '' (current dir) in the C<PATH>
 environment variable; the C<PATH> itself is not modified.  This

-flag is I<@ignore_dot@> by default.  Currently, while it is possible
-to set I<ignore_dot> in I<sudoers>, its value is not used.  This option
-should be considered read-only (it will be fixed in a future version
-of B<sudo>).
+flag is I<@ignore_dot@> by default.

 
 =item ignore_local_sudoers
 
 
 =item ignore_local_sudoers
 

-If set via LDAP, parsing of @sysconfdir@/sudoers will be skipped.
+If set via LDAP, parsing of F<@sysconfdir@/sudoers> will be skipped.

 This is intended for Enterprises that wish to prevent the usage of local
 sudoers files so that only LDAP is used.  This thwarts the efforts of
 This is intended for Enterprises that wish to prevent the usage of local
 sudoers files so that only LDAP is used.  This thwarts the efforts of

-rogue operators who would attempt to add roles to @sysconfdir@/sudoers.
-When this option is present, @sysconfdir@/sudoers does not even need to exist. 
-Since this option tells B<sudo> how to behave when no specific LDAP entries
-have been matched, this sudoOption is only meaningful for the cn=defaults
-section.  This flag is I<off> by default.
+rogue operators who would attempt to add roles to F<@sysconfdir@/sudoers>.
+When this option is present, F<@sysconfdir@/sudoers> does not even need to
+exist. Since this option tells B<sudo> how to behave when no specific LDAP
+entries have been matched, this sudoOption is only meaningful for the
+C<cn=defaults> section.  This flag is I<off> by default.

 
 =item insults
 
 
 =item insults
 


@@ -582,26 +711,35 @@ by default.
 =item passprompt_override
 
 The password prompt specified by I<passprompt> will normally only
 =item passprompt_override
 
 The password prompt specified by I<passprompt> will normally only

-be used if the passwod prompt provided by systems such as PAM matches
+be used if the password prompt provided by systems such as PAM matches

 the string "Password:".  If I<passprompt_override> is set, I<passprompt>
 will always be used.  This flag is I<off> by default.
 
 =item preserve_groups
 
 the string "Password:".  If I<passprompt_override> is set, I<passprompt>
 will always be used.  This flag is I<off> by default.
 
 =item preserve_groups
 

-By default B<sudo> will initialize the group vector to the list of
+By default, B<sudo> will initialize the group vector to the list of

 groups the target user is in.  When I<preserve_groups> is set, the
 user's existing group vector is left unaltered.  The real and
 effective group IDs, however, are still set to match the target
 user.  This flag is I<off> by default.
 
 groups the target user is in.  When I<preserve_groups> is set, the
 user's existing group vector is left unaltered.  The real and
 effective group IDs, however, are still set to match the target
 user.  This flag is I<off> by default.
 

+=item pwfeedback
+
+By default, B<sudo> reads the password like most other Unix programs,
+by turning off echo until the user hits the return (or enter) key.
+Some users become confused by this as it appears to them that B<sudo>
+has hung at this point.  When I<pwfeedback> is set, B<sudo> will
+provide visual feedback when the user presses a key.  Note that
+this does have a security impact as an onlooker may be able to
+determine the length of the password being entered.
+This flag is I<off> by default.
+

 =item requiretty
 
 If set, B<sudo> will only run when the user is logged in to a real
 =item requiretty
 
 If set, B<sudo> will only run when the user is logged in to a real

-tty.  This will disallow things like C<"rsh somehost sudo ls"> since
-L<rsh(1)> does not allocate a tty.  Because it is not possible to turn
-off echo when there is no tty present, some sites may wish to set
-this flag to prevent a user from entering a visible password.  This
-flag is I<off> by default.
+tty.  When this flag is set, B<sudo> can only be run from a login
+session and not via other means such as L<cron(8)> or cgi-bin scripts.
+This flag is I<off> by default.

 
 =item root_sudo
 
 
 =item root_sudo
 


@@ -626,16 +764,16 @@ password of the invoking user.  This flag is I<off> by default.
 
 =item set_home
 
 
 =item set_home
 

-If set and B<sudo> is invoked with the B<-s> flag the C<HOME>
+If set and B<sudo> is invoked with the B<-s> option the C<HOME>

 environment variable will be set to the home directory of the target
 user (which is root unless the B<-u> option is used).  This effectively
 environment variable will be set to the home directory of the target
 user (which is root unless the B<-u> option is used).  This effectively

-makes the B<-s> flag imply B<-H>.  This flag is I<off> by default.
+makes the B<-s> option imply B<-H>.  This flag is I<off> by default.

 
 =item set_logname
 
 Normally, B<sudo> will set the C<LOGNAME>, C<USER> and C<USERNAME>
 environment variables to the name of the target user (usually root
 
 =item set_logname
 
 Normally, B<sudo> will set the C<LOGNAME>, C<USER> and C<USERNAME>
 environment variables to the name of the target user (usually root

-unless the B<-u> flag is given).  However, since some programs
+unless the B<-u> option is given).  However, since some programs

 (including the RCS revision control system) use C<LOGNAME> to
 determine the real identity of the user, it may be desirable to
 change this behavior.  This can be done by negating the set_logname
 (including the RCS revision control system) use C<LOGNAME> to
 determine the real identity of the user, it may be desirable to
 change this behavior.  This can be done by negating the set_logname


@@ -655,11 +793,28 @@ by default.
 =item shell_noargs
 
 If set and B<sudo> is invoked with no arguments it acts as if the
 =item shell_noargs
 
 If set and B<sudo> is invoked with no arguments it acts as if the

-B<-s> flag had been given.  That is, it runs a shell as root (the
+B<-s> option had been given.  That is, it runs a shell as root (the

 shell is determined by the C<SHELL> environment variable if it is
 set, falling back on the shell listed in the invoking user's
 /etc/passwd entry if not).  This flag is I<off> by default.
 
 shell is determined by the C<SHELL> environment variable if it is
 set, falling back on the shell listed in the invoking user's
 /etc/passwd entry if not).  This flag is I<off> by default.
 

+=item fast_glob
+
+Normally, B<sudo> uses the L<glob(3)> function to do shell-style
+globbing when matching pathnames.  However, since it accesses the
+file system, L<glob(3)> can take a long time to complete for some
+patterns, especially when the pattern references a network file
+system that is mounted on demand (automounted).  The I<fast_glob>
+option causes B<sudo> to use the L<fnmatch(3)> function, which does
+not access the file system to do its matching.  The disadvantage
+of I<fast_glob> is that it is unable to match relative pathnames
+such as F<./ls> or F<../bin/ls>.  This has security implications
+when path names that include globbing characters are used with the
+negation operator, C<'!'>, as such rules can be trivially bypassed.
+As such, this option should not be used when I<sudoers> contains rules
+that contain negated path names which include globbing characters.
+This flag is I<off> by default.
+

 =item stay_setuid
 
 Normally, when B<sudo> executes a command the real and effective
 =item stay_setuid
 
 Normally, when B<sudo> executes a command the real and effective


@@ -674,9 +829,9 @@ function.  This flag is I<off> by default.
 =item targetpw
 
 If set, B<sudo> will prompt for the password of the user specified by
 =item targetpw
 
 If set, B<sudo> will prompt for the password of the user specified by

-the B<-u> flag (defaults to C<root>) instead of the password of the
+the B<-u> option (defaults to C<root>) instead of the password of the

 invoking user.  Note that this precludes the use of a uid not listed
 invoking user.  Note that this precludes the use of a uid not listed

-in the passwd database as an argument to the B<-u> flag.
+in the passwd database as an argument to the B<-u> option.

 This flag is I<off> by default.
 
 =item tty_tickets
 This flag is I<off> by default.
 
 =item tty_tickets


@@ -687,18 +842,44 @@ the user running it.  With this flag enabled, B<sudo> will use a
 file named for the tty the user is logged in on in that directory.
 This flag is I<@tty_tickets@> by default.
 
 file named for the tty the user is logged in on in that directory.
 This flag is I<@tty_tickets@> by default.
 

+=item umask_override
+
+If set, B<sudo> will set the umask as specified by I<sudoers> without
+modification.  This makes it possible to specify a more permissive
+umask in I<sudoers> than the user's own umask and matches historical
+behavior.  If I<umask_override> is not set, B<sudo> will set the
+umask to be the union of the user's umask and what is specified in
+I<sudoers>.  This flag is I<off> by default.
+

 =item use_loginclass
 
 If set, B<sudo> will apply the defaults specified for the target user's
 login class if one exists.  Only available if B<sudo> is configured with
 the --with-logincap option.  This flag is I<off> by default.
 
 =item use_loginclass
 
 If set, B<sudo> will apply the defaults specified for the target user's
 login class if one exists.  Only available if B<sudo> is configured with
 the --with-logincap option.  This flag is I<off> by default.
 

+=item visiblepw
+
+By default, B<sudo> will refuse to run if the user must enter a
+password but it is not possible to disable echo on the terminal.
+If the I<visiblepw> flag is set, B<sudo> will prompt for a password
+even when it would be visible on the screen.  This makes it possible
+to run things like C<"rsh somehost sudo ls"> since L<rsh(1)> does
+not allocate a tty.  This flag is I<off> by default.
+

 =back
 
 B<Integers>:
 
 =over 16
 
 =back
 
 B<Integers>:
 
 =over 16
 

+=item closefrom
+
+Before it executes a command, B<sudo> will close all open file
+descriptors other than standard input, standard output and standard
+error (ie: file descriptors 0-2).  The I<closefrom> option can be used
+to specify a different file descriptor at which to start closing.
+The default is C<3>.
+

 =item passwd_tries
 
 The number of tries a user gets to enter his/her password before
 =item passwd_tries
 
 The number of tries a user gets to enter his/her password before


@@ -734,7 +915,12 @@ own timestamps via C<sudo -v> and C<sudo -k> respectively.
 =item umask
 
 Umask to use when running the command.  Negate this option or set
 =item umask
 
 Umask to use when running the command.  Negate this option or set

-it to 0777 to preserve the user's umask.  The default is C<@sudo_umask@>.
+it to 0777 to preserve the user's umask.  The actual umask that is
+used will be the union of the user's umask and C<@sudo_umask@>.
+This guarantees that B<sudo> never lowers the umask when running a
+command.  Note on systems that use PAM, the default PAM configuration
+may specify its own umask which will override the value set in
+I<sudoers>.

 
 =back
 
 
 =back
 


@@ -786,6 +972,11 @@ option is set)
 
 expanded to the local hostname without the domain name
 
 
 expanded to the local hostname without the domain name
 

+=item C<%p>
+
+expanded to the user whose password is being asked for (respects the 
+I<rootpw>, I<targetpw> and I<runaspw> flags in I<sudoers>)
+

 =item C<%U>
 
 expanded to the login name of the user the command will
 =item C<%U>
 
 expanded to the login name of the user the command will


@@ -803,9 +994,16 @@ two consecutive C<%> characters are collapsed into a single C<%> character
 
 The default value is C<@passprompt@>.
 
 
 The default value is C<@passprompt@>.
 

+=item role
+
+The default SELinux role to use when constructing a new security
+context to run the command.  The default role may be overridden on
+a per-command basis in I<sudoers> or via command line options.
+This option is only available whe B<sudo> is built with SELinux support.
+

 =item runas_default
 
 =item runas_default
 

-The default user to run commands as if the B<-u> flag is not specified
+The default user to run commands as if the B<-u> option is not specified

 on the command line.  This defaults to C<@runas_default@>.
 Note that if I<runas_default> is set it B<must> occur before
 any C<Runas_Alias> specifications.
 on the command line.  This defaults to C<@runas_default@>.
 Note that if I<runas_default> is set it B<must> occur before
 any C<Runas_Alias> specifications.


@@ -820,6 +1018,12 @@ Defaults to C<@badpri@>.
 Syslog priority to use when user authenticates successfully.
 Defaults to C<@goodpri@>.
 
 Syslog priority to use when user authenticates successfully.
 Defaults to C<@goodpri@>.
 

+=item sudoers_locale
+
+Locale to use when parsing the sudoers file.  Note that changing
+the locale may affect how sudoers is interpreted.
+Defaults to C<"C">.
+

 =item timestampdir
 
 The directory in which B<sudo> stores its timestamp files.
 =item timestampdir
 
 The directory in which B<sudo> stores its timestamp files.


@@ -830,12 +1034,40 @@ The default is F<@timedir@>.
 The owner of the timestamp directory and the timestamps stored therein.
 The default is C<root>.
 
 The owner of the timestamp directory and the timestamps stored therein.
 The default is C<root>.
 

+=item type
+
+The default SELinux type to use when constructing a new security
+context to run the command.  The default type may be overridden on
+a per-command basis in I<sudoers> or via command line options.
+This option is only available whe B<sudo> is built with SELinux support.
+

 =back
 
 B<Strings that can be used in a boolean context>:
 
 =over 12
 
 =back
 
 B<Strings that can be used in a boolean context>:
 
 =over 12
 

+=item askpass
+
+The I<askpass> option specifies the fully qualified path to a helper
+program used to read the user's password when no terminal is
+available.  This may be the case when B<sudo> is executed from a
+graphical (as opposed to text-based) application.  The program
+specified by I<askpass> should display the argument passed to it
+as the prompt and write the user's password to the standard output.
+The value of I<askpass> may be overridden by the C<SUDO_ASKPASS>
+environment variable.
+
+=item env_file
+
+The I<env_file> options specifies the fully qualified path to a
+file containing variables to be set in the environment of the program
+being run.  Entries in this file should either be of the form
+C<VARIABLE=value> or C<export VARIABLE=value>.  The value may
+optionally be surrounded by single or double quotes.  Variables in
+this file are subject to other B<sudo> environment settings such
+as I<env_keep> and I<env_check>.
+

 =item exempt_group
 
 Users in this group are exempt from password and PATH requirements.
 =item exempt_group
 
 Users in this group are exempt from password and PATH requirements.


@@ -875,7 +1107,7 @@ By default, B<sudo> uses a built-in lecture.
 =item listpw
 
 This option controls when a password will be required when a
 =item listpw
 
 This option controls when a password will be required when a

-user runs B<sudo> with the B<-l> flag.  It has the following possible values:
+user runs B<sudo> with the B<-l> option.  It has the following possible values:

 
 =over 8
 
 
 =over 8
 


@@ -886,7 +1118,7 @@ the C<NOPASSWD> flag set to avoid entering a password.
 
 =item always
 
 
 =item always
 

-The user must always enter a password to use the B<-l> flag.
+The user must always enter a password to use the B<-l> option.

 
 =item any
 
 
 =item any
 


@@ -895,7 +1127,7 @@ must have the C<NOPASSWD> flag set to avoid entering a password.
 
 =item never
 
 
 =item never
 

-The user need never enter a password to use the B<-l> flag.
+The user need never enter a password to use the B<-l> option.

 
 =back
 
 
 =back
 


@@ -918,12 +1150,28 @@ Flags to use when invoking mailer. Defaults to B<-t>.
 Path to mail program used to send warning mail.
 Defaults to the path to sendmail found at configure time.
 
 Path to mail program used to send warning mail.
 Defaults to the path to sendmail found at configure time.
 

+=item mailfrom
+
+Address to use for the "from" address when sending warning and error
+mail.  The address should be enclosed in double quotes (C<">) to
+protect against B<sudo> interpreting the C<@> sign.  Defaults to
+the name of the user running B<sudo>.
+

 =item mailto
 
 Address to send warning and error mail to.  The address should
 be enclosed in double quotes (C<">) to protect against B<sudo>
 interpreting the C<@> sign.  Defaults to C<@mailto@>.
 
 =item mailto
 
 Address to send warning and error mail to.  The address should
 be enclosed in double quotes (C<">) to protect against B<sudo>
 interpreting the C<@> sign.  Defaults to C<@mailto@>.
 

+=item secure_path
+
+Path used for every command run from B<sudo>.  If you don't trust the
+people running B<sudo> to have a sane C<PATH> environment variable you may
+want to use this.  Another use is if you want to have the "root path"
+be separate from the "user path."  Users in the group specified by the
+I<exempt_group> option are not affected by I<secure_path>.
+This option is @secure_path@ by default.
+

 =item syslog
 
 Syslog facility if syslog is being used for logging (negate to
 =item syslog
 
 Syslog facility if syslog is being used for logging (negate to


@@ -932,7 +1180,7 @@ disable syslog logging).  Defaults to C<@logfac@>.
 =item verifypw
 
 This option controls when a password will be required when a user runs
 =item verifypw
 
 This option controls when a password will be required when a user runs

-B<sudo> with the B<-v> flag.  It has the following possible values:
+B<sudo> with the B<-v> option.  It has the following possible values:

 
 =over 8
 
 
 =over 8
 


@@ -943,7 +1191,7 @@ the C<NOPASSWD> flag set to avoid entering a password.
 
 =item always
 
 
 =item always
 

-The user must always enter a password to use the B<-v> flag.
+The user must always enter a password to use the B<-v> option.

 
 =item any
 
 
 =item any
 


@@ -952,7 +1200,7 @@ must have the C<NOPASSWD> flag set to avoid entering a password.
 
 =item never
 
 
 =item never
 

-The user need never enter a password to use the B<-v> flag.
+The user need never enter a password to use the B<-v> option.

 
 =back
 
 
 =back
 


@@ -983,15 +1231,16 @@ the I<-V> option.
 
 =item env_delete
 
 
 =item env_delete
 

-Environment variables to be removed from the user's environment.
-The argument may be a double-quoted, space-separated list or a
-single value without double-quotes.  The list can be replaced, added
-to, deleted from, or disabled by using the C<=>, C<+=>, C<-=>, and
-C<!> operators respectively.  The default list of environment
-variables to remove is displayed when B<sudo> is run by root with the
-I<-V> option.  Note that many operating systems will remove potentially
-dangerous variables from the environment of any setuid process (such
-as B<sudo>).
+Environment variables to be removed from the user's environment
+when the I<env_reset> option is not in effect.  The argument may
+be a double-quoted, space-separated list or a single value without
+double-quotes.  The list can be replaced, added to, deleted from,
+or disabled by using the C<=>, C<+=>, C<-=>, and C<!> operators
+respectively.  The default list of environment variables to remove
+is displayed when B<sudo> is run by root with the I<-V> option.
+Note that many operating systems will remove potentially dangerous
+variables from the environment of any setuid process (such as
+B<sudo>).

 
 =item env_keep
 
 
 =item env_keep
 


@@ -1016,28 +1265,24 @@ B<notice>, and B<warning>.
 
 =head1 FILES
 
 
 =head1 FILES
 

-=over 4
+=over 24
+
+=item F<@sysconfdir@/sudoers>

 
 

-=item F<@sysconfdir@/sudoers>C<                >

 List of who can run what
 
 List of who can run what
 

-=item F</etc/group>C<          >
+=item F</etc/group>
+

 Local groups file
 
 Local groups file
 

-=item F</etc/netgroup>C<               >
+=item F</etc/netgroup>
+

 List of network groups
 
 =back
 
 =head1 EXAMPLES
 
 List of network groups
 
 =back
 
 =head1 EXAMPLES
 

-Since the I<sudoers> file is parsed in a single pass, order is
-important.  In general, you should structure I<sudoers> such that
-the C<Host_Alias>, C<User_Alias>, and C<Cmnd_Alias> specifications
-come first, followed by any C<Default_Entry> lines, and finally the
-C<Runas_Alias> and user specifications.  The basic rule of thumb
-is you cannot reference an Alias that has not already been defined.
-

 Below are example I<sudoers> entries.  Admittedly, some of
 these are a bit contrived.  First, we define our I<aliases>:
 
 Below are example I<sudoers> entries.  Admittedly, some of
 these are a bit contrived.  First, we define our I<aliases>:
 


@@ -1049,6 +1294,7 @@ these are a bit contrived.  First, we define our I<aliases>:
  # Runas alias specification
  Runas_Alias   OP = root, operator
  Runas_Alias   DB = oracle, sybase
  # Runas alias specification
  Runas_Alias   OP = root, operator
  Runas_Alias   DB = oracle, sybase

+ Runas_Alias   ADMINGRP = adm, oper

 
  # Host alias specification
  Host_Alias    SPARC = bigtime, eclipse, moet, anchor :\
 
  # Host alias specification
  Host_Alias    SPARC = bigtime, eclipse, moet, anchor :\


@@ -1140,7 +1386,13 @@ directory F</usr/oper/bin/>.
 
 The user B<joe> may only L<su(1)> to operator.
 
 
 The user B<joe> may only L<su(1)> to operator.
 

- pete          HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
+ pete          HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root
+
+ %opers                ALL = (: ADMINGRP) /usr/sbin/
+
+Users in the B<opers> group may run commands in F</usr/sbin/> as themselves
+with any group in the I<ADMINGRP> C<Runas_Alias> (the B<adm> and B<oper>
+groups).

 
 The user B<pete> is allowed to change anyone's password except for
 root on the I<HPPA> machines.  Note that this assumes L<passwd(1)>
 
 The user B<pete> is allowed to change anyone's password except for
 root on the I<HPPA> machines.  Note that this assumes L<passwd(1)>


@@ -1170,7 +1422,7 @@ The user B<fred> can run commands as any user in the I<DB> C<Runas_Alias>
  john          ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
 
 On the I<ALPHA> machines, user B<john> may su to anyone except root
  john          ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
 
 On the I<ALPHA> machines, user B<john> may su to anyone except root

-but he is not allowed to give L<su(1)> any flags.
+but he is not allowed to specify any options to the L<su(1)> command.

 
  jen           ALL, !SERVERS = ALL
 
 
  jen           ALL, !SERVERS = ALL
 


@@ -1222,6 +1474,22 @@ different name, or use a shell escape from an editor or other
 program.  Therefore, these kind of restrictions should be considered
 advisory at best (and reinforced by policy).
 
 program.  Therefore, these kind of restrictions should be considered
 advisory at best (and reinforced by policy).
 

+Furthermore, if the I<fast_glob> option is in use, it is not possible
+to reliably negate commands where the path name includes globbing
+(aka wildcard) characters.  This is because the C library's
+L<fnmatch(3)> function cannot resolve relative paths.  While this
+is typically only an inconvenience for rules that grant privileges,
+it can result in a security issue for rules that subtract or revoke
+privileges.
+
+For example, given the following I<sudoers> entry:
+
+ john  ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,
+      /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
+
+User B<john> can still run C</usr/bin/passwd root> if I<fast_glob> is
+enabled by changing to F</usr/bin> and running C<./passwd root> instead.
+

 =head1 PREVENTING SHELL ESCAPES
 
 Once B<sudo> executes a program, that program is free to do whatever
 =head1 PREVENTING SHELL ESCAPES
 
 Once B<sudo> executes a program, that program is free to do whatever


@@ -1297,7 +1565,7 @@ B<sudoedit>.
 
 =head1 SEE ALSO
 
 
 =head1 SEE ALSO
 

-L<rsh(1)>, L<su(1)>, L<fnmatch(3)>, L<sudo(8)>, L<visudo(8)>
+L<rsh(1)>, L<su(1)>, L<fnmatch(3)>, L<glob(3)>, L<sudo(8)>, L<visudo(8)>

 
 =head1 CAVEATS
 
 
 =head1 CAVEATS