X-Git-Url: https://git.gag.com/?a=blobdiff_plain;f=doc%2Fsudoers.cat;h=b98c1e5afe5e9d9274d9ccb25358ae8c305b3478;hb=ca5f7615983706c51b50ac5a8bfc4e123263df0e;hp=2459758172ab19510b3a17915ee3c2e4a2fae192;hpb=0b21e55969badb5a284e97d31432c3f9139bed27;p=debian%2Fsudo diff --git a/doc/sudoers.cat b/doc/sudoers.cat index 2459758..b98c1e5 100644 --- a/doc/sudoers.cat +++ b/doc/sudoers.cat @@ -65,10 +65,11 @@ DDEESSCCRRIIPPTTIIOONN distinct ways _s_u_d_o_e_r_s can deal with environment variables. By default, the _e_n_v___r_e_s_e_t option is enabled. This causes commands to - be executed with a minimal environment containing TERM, PATH, HOME, - MAIL, SHELL, LOGNAME, USER and USERNAME in addition to variables from - the invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p options. - This is effectively a whitelist for environment variables. + be executed with a minimal environment containing the TERM, PATH, HOME, + MAIL, SHELL, LOGNAME, USER, USERNAME and SUDO_* variables in addition + to variables from the invoking process permitted by the _e_n_v___c_h_e_c_k and + _e_n_v___k_e_e_p options. This is effectively a whitelist for environment + variables. If, however, the _e_n_v___r_e_s_e_t option is disabled, any variables not explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited @@ -97,6 +98,9 @@ DDEESSCCRRIIPPTTIIOONN On Linux and AIX systems the contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t are also included. All other environment variables are removed. + Lastly, if the _e_n_v___f_i_l_e option is defined, any variables present in + that file will be set to their specified values. + SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT The _s_u_d_o_e_r_s file is composed of two types of entries: aliases (basically variables) and user specifications (which specify who may @@ -560,8 +564,16 @@ SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT A hard limit of 128 nested include files is enforced to prevent include file loops. - The file name may include the %h escape, signifying the short form of - the host name. I.e., if the machine's host name is "xerxes", then + If the path to the include file is not fully-qualified (does not begin + with a _/), it must be located in the same directory as the sudoers file + it was included from. For example, if _/_e_t_c_/_s_u_d_o_e_r_s contains the line: + + #include sudoers.local + + the file that will be included is _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l. + + The file name may also include the %h escape, signifying the short form + of the host name. I.e., if the machine's host name is "xerxes", then #include /etc/sudoers.%h @@ -662,15 +674,18 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS use the EDITOR or VISUAL if they match a value specified in editor. This flag is _o_f_f by default. - env_reset If set, ssuuddoo will reset the environment to only contain - the LOGNAME, MAIL, SHELL, USER, USERNAME and the SUDO_* - variables. Any variables in the caller's environment - that match the env_keep and env_check lists are then - added. The default contents of the env_keep and - env_check lists are displayed when ssuuddoo is run by root - with the _-_V option. If the _s_e_c_u_r_e___p_a_t_h option is set, - its value will be used for the PATH environment - variable. This flag is _o_n by default. + env_reset If set, ssuuddoo will run the command in a minimal + environment containing the TERM, PATH, HOME, MAIL, + SHELL, LOGNAME, USER, USERNAME and SUDO_* variables. + Any variables in the caller's environment that match + the env_keep and env_check lists are then added, + followed by any variables present in the file specified + by the _e_n_v___f_i_l_e option (if any). The default contents + of the env_keep and env_check lists are displayed when + ssuuddoo is run by root with the _-_V option. If the + _s_e_c_u_r_e___p_a_t_h option is set, its value will be used for + the PATH environment variable. This flag is _o_n by + default. fast_glob Normally, ssuuddoo uses the _g_l_o_b(3) function to do shell- style globbing when matching path names. However, @@ -1087,9 +1102,9 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS %h will expand to the host name of the machine. Default is *** SECURITY information for %h ***. - noexec_file This option is deprecated and will be removed in a - future release of ssuuddoo. The path to the noexec file - should now be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f file. + noexec_file This option is no longer supported. The path to the + noexec file should now be set in the _/_e_t_c_/_s_u_d_o_._c_o_n_f + file. passprompt The default prompt to use when asking for a password; can be overridden via the --pp option or the SUDO_PROMPT @@ -1158,8 +1173,8 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: - env_file The _e_n_v___f_i_l_e options specifies the fully qualified path to - a file containing variables to be set in the environment of + env_file The _e_n_v___f_i_l_e option specifies the fully qualified path to a + file containing variables to be set in the environment of the program being run. Entries in this file should either be of the form VARIABLE=value or export VARIABLE=value. The value may optionally be surrounded by single or double @@ -1606,6 +1621,57 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS privilege escalation. In the specific case of an editor, a safer approach is to give the user permission to run ssuuddooeeddiitt. +DDEEBBUUGG FFLLAAGGSS + Versions 1.8.4 and higher of the _s_u_d_o_e_r_s plugin supports a debugging + framework that can help track down what the plugin is doing internally + if there is a problem. This can be configured in the _/_e_t_c_/_s_u_d_o_._c_o_n_f + file as described in _s_u_d_o(1m). + + The _s_u_d_o_e_r_s plugin uses the same debug flag format as ssuuddoo itself: + _s_u_b_s_y_s_t_e_m@_p_r_i_o_r_i_t_y. + + The priorities used by _s_u_d_o_e_r_s, in order of decreasing severity, are: + _c_r_i_t, _e_r_r, _w_a_r_n, _n_o_t_i_c_e, _d_i_a_g, _i_n_f_o, _t_r_a_c_e and _d_e_b_u_g. Each priority, + when specified, also includes all priorities higher than it. For + example, a priority of _n_o_t_i_c_e would include debug messages logged at + _n_o_t_i_c_e and higher. + + The following subsystems are used by _s_u_d_o_e_r_s: + + _a_l_i_a_s User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias processing + + _a_l_l matches every subsystem + + _a_u_d_i_t BSM and Linux audit code + + _a_u_t_h user authentication + + _d_e_f_a_u_l_t_s _s_u_d_o_e_r_s _D_e_f_a_u_l_t_s settings + + _e_n_v environment handling + + _l_d_a_p LDAP-based sudoers + + _l_o_g_g_i_n_g logging support + + _m_a_t_c_h matching of users, groups, hosts and netgroups in _s_u_d_o_e_r_s + + _n_e_t_i_f network interface handling + + _n_s_s network service switch handling in _s_u_d_o_e_r_s + + _p_a_r_s_e_r _s_u_d_o_e_r_s file parsing + + _p_e_r_m_s permission setting + + _p_l_u_g_i_n The equivalent of _m_a_i_n for the plugin. + + _p_t_y pseudo-tty related code + + _r_b_t_r_e_e redblack tree internals + + _u_t_i_l utility functions + SSEECCUURRIITTYY NNOOTTEESS _s_u_d_o_e_r_s will check the ownership of its time stamp directory (_/_v_a_r_/_a_d_m_/_s_u_d_o by default) and ignore the directory's contents if it is @@ -1683,4 +1749,4 @@ DDIISSCCLLAAIIMMEERR -1.8.3 September 16, 2011 SUDOERS(4) +1.8.4 February 5, 2012 SUDOERS(4)