#
# @configure_input@
#
- # $Sudo: Makefile.in,v 1.246.2.30 2008/03/23 19:43:51 millert Exp $
+ # $Sudo: Makefile.in,v 1.246.2.31 2008/05/08 19:48:23 millert Exp $
#
#### Start of system configuration section. ####
LIBOBJS = @LIBOBJS@ @ALLOCA@
- VERSION = 1.6.9p15
+ VERSION = 1.6.9p16
DISTFILES = $(SRCS) $(HDRS) BUGS CHANGES HISTORY INSTALL INSTALL.configure \
LICENSE Makefile.in PORTING README README.LDAP \
@DEV@PARSESRCS = sudo.tab.h sudo.tab.c lex.yy.c def_data.c def_data.h
# Uncomment the following if you intend to modify parse.yacc
-@DEV@sudo.tab.c sudo.tab.h: parse.yacc
-@DEV@ rm -f sudo.tab.h sudo.tab.c
-@DEV@ $(YACC) -d -b sudo $(srcdir)/parse.yacc
+sudo.tab.c sudo.tab.h: parse.yacc
+ rm -f sudo.tab.h sudo.tab.c
+ $(YACC) -d -b sudo $(srcdir)/parse.yacc
# Uncomment the following if you intend to modify parse.lex
@DEV@lex.yy.c: parse.lex
$(INSTALL) -O $(sudoers_uid) -G $(sudoers_gid) -M $(sudoers_mode) \
$(srcdir)/sudoers $(DESTDIR)$(sudoersdir)/sudoers
-install-man:
+install-man: sudo.$(mantype) visudo.$(mantype) sudoers.$(mantype)
$(INSTALL) -O $(install_uid) -G $(install_gid) -M 0444 @mansrcdir@/sudo.$(mantype) $(DESTDIR)$(mandirsu)/sudo.$(mansectsu)
@rm -f $(DESTDIR)$(mandirsu)/sudoedit.$(mansectsu)
ln $(DESTDIR)$(mandirsu)/sudo.$(mansectsu) $(DESTDIR)$(mandirsu)/sudoedit.$(mansectsu)
fi ; \
cp $(srcdir)/INSTALL.binary $$tdir/INSTALL ; \
sh ./config.status --file=Makefile.binary && cp Makefile.binary $$tdir/Makefile ; \
- strip sudo ; \
- strip visudo ; \
cd tmp.$$ARCH && tar Ocf ../sudo-$(VERSION)-$$ARCH.tar sudo-$(VERSION) && cd .. ; \
gzip --best sudo-$(VERSION)-$$ARCH.tar ; \
rm -rf tmp.$$ARCH ; \
--bindir=DIR user executables [EPREFIX/bin]
--sbindir=DIR system admin executables [EPREFIX/sbin]
--libexecdir=DIR program executables [EPREFIX/libexec]
- --sysconfdir=DIR read-only single-machine data [etc]
+ --sysconfdir=DIR read-only single-machine data [PREFIX/etc]
--sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
--localstatedir=DIR modifiable single-machine data [PREFIX/var]
--libdir=DIR object code libraries [EPREFIX/lib]
int
main ()
{
- DIR *d; (void)dirfd(d);
+ DIR d; (void)dirfd(&d);
;
return 0;
}
echo "$as_me: WARNING: unable to find socket() trying -lsocket -lnsl" >&2;}
{ echo "$as_me:$LINENO: checking for socket in -lsocket" >&5
echo $ECHO_N "checking for socket in -lsocket... $ECHO_C" >&6; }
- if test "${ac_cv_lib_socket_socket+set}" = set; then
+ if test "${ac_cv_lib_socket_socket_lnsl+set}" = set; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
test ! -s conftest.err
} && test -s conftest$ac_exeext &&
$as_test_x conftest$ac_exeext; then
- ac_cv_lib_socket_socket=yes
+ ac_cv_lib_socket_socket_lnsl=yes
else
echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
- ac_cv_lib_socket_socket=no
+ ac_cv_lib_socket_socket_lnsl=no
fi
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
- { echo "$as_me:$LINENO: result: $ac_cv_lib_socket_socket" >&5
- echo "${ECHO_T}$ac_cv_lib_socket_socket" >&6; }
- if test $ac_cv_lib_socket_socket = yes; then
+ { echo "$as_me:$LINENO: result: $ac_cv_lib_socket_socket_lnsl" >&5
+ echo "${ECHO_T}$ac_cv_lib_socket_socket_lnsl" >&6; }
+ if test $ac_cv_lib_socket_socket_lnsl = yes; then
NET_LIBS="${NET_LIBS} -lsocket -lnsl"; LIBS="${LIBS} -lsocket -lnsl"
fi
echo "$as_me: WARNING: unable to find inet_addr() trying -lsocket -lnsl" >&2;}
{ echo "$as_me:$LINENO: checking for inet_addr in -lsocket" >&5
echo $ECHO_N "checking for inet_addr in -lsocket... $ECHO_C" >&6; }
- if test "${ac_cv_lib_socket_inet_addr+set}" = set; then
+ if test "${ac_cv_lib_socket_inet_addr_lnsl+set}" = set; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
test ! -s conftest.err
} && test -s conftest$ac_exeext &&
$as_test_x conftest$ac_exeext; then
- ac_cv_lib_socket_inet_addr=yes
+ ac_cv_lib_socket_inet_addr_lnsl=yes
else
echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
- ac_cv_lib_socket_inet_addr=no
+ ac_cv_lib_socket_inet_addr_lnsl=no
fi
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
- { echo "$as_me:$LINENO: result: $ac_cv_lib_socket_inet_addr" >&5
- echo "${ECHO_T}$ac_cv_lib_socket_inet_addr" >&6; }
- if test $ac_cv_lib_socket_inet_addr = yes; then
+ { echo "$as_me:$LINENO: result: $ac_cv_lib_socket_inet_addr_lnsl" >&5
+ echo "${ECHO_T}$ac_cv_lib_socket_inet_addr_lnsl" >&6; }
+ if test $ac_cv_lib_socket_inet_addr_lnsl = yes; then
NET_LIBS="${NET_LIBS} -lsocket -lnsl"; LIBS="${LIBS} -lsocket -lnsl"
fi
#
{ echo "$as_me:$LINENO: checking for SD_Init in -laceclnt" >&5
echo $ECHO_N "checking for SD_Init in -laceclnt... $ECHO_C" >&6; }
- if test "${ac_cv_lib_aceclnt_SD_Init+set}" = set; then
+ if test "${ac_cv_lib_aceclnt_SD_Init_______lpthread_______+set}" = set; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
test ! -s conftest.err
} && test -s conftest$ac_exeext &&
$as_test_x conftest$ac_exeext; then
- ac_cv_lib_aceclnt_SD_Init=yes
+ ac_cv_lib_aceclnt_SD_Init_______lpthread_______=yes
else
echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
- ac_cv_lib_aceclnt_SD_Init=no
+ ac_cv_lib_aceclnt_SD_Init_______lpthread_______=no
fi
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
- { echo "$as_me:$LINENO: result: $ac_cv_lib_aceclnt_SD_Init" >&5
- echo "${ECHO_T}$ac_cv_lib_aceclnt_SD_Init" >&6; }
- if test $ac_cv_lib_aceclnt_SD_Init = yes; then
+ { echo "$as_me:$LINENO: result: $ac_cv_lib_aceclnt_SD_Init_______lpthread_______" >&5
+ echo "${ECHO_T}$ac_cv_lib_aceclnt_SD_Init_______lpthread_______" >&6; }
+ if test $ac_cv_lib_aceclnt_SD_Init_______lpthread_______ = yes; then
AUTH_OBJS="$AUTH_OBJS securid5.o";
SUDO_LIBS="${SUDO_LIBS} -laceclnt -lpthread"
fi
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- { echo "$as_me:$LINENO: checking for main in -lkrb" >&5
+ as_ac_Lib=`echo "ac_cv_lib_krb_main$K4LIBS" | $as_tr_sh`
+ { echo "$as_me:$LINENO: checking for main in -lkrb" >&5
echo $ECHO_N "checking for main in -lkrb... $ECHO_C" >&6; }
- if test "${ac_cv_lib_krb_main+set}" = set; then
+ if { as_var=$as_ac_Lib; eval "test \"\${$as_var+set}\" = set"; }; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
test ! -s conftest.err
} && test -s conftest$ac_exeext &&
$as_test_x conftest$ac_exeext; then
- ac_cv_lib_krb_main=yes
+ eval "$as_ac_Lib=yes"
else
echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
- ac_cv_lib_krb_main=no
+ eval "$as_ac_Lib=no"
fi
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
- { echo "$as_me:$LINENO: result: $ac_cv_lib_krb_main" >&5
- echo "${ECHO_T}$ac_cv_lib_krb_main" >&6; }
- if test $ac_cv_lib_krb_main = yes; then
+ ac_res=`eval echo '${'$as_ac_Lib'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+ echo "${ECHO_T}$ac_res" >&6; }
+ if test `eval echo '${'$as_ac_Lib'}'` = yes; then
K4LIBS="-lkrb $K4LIBS"
else
- { echo "$as_me:$LINENO: checking for main in -lkrb4" >&5
+ as_ac_Lib=`echo "ac_cv_lib_krb4_main$K4LIBS" | $as_tr_sh`
+ { echo "$as_me:$LINENO: checking for main in -lkrb4" >&5
echo $ECHO_N "checking for main in -lkrb4... $ECHO_C" >&6; }
- if test "${ac_cv_lib_krb4_main+set}" = set; then
+ if { as_var=$as_ac_Lib; eval "test \"\${$as_var+set}\" = set"; }; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_check_lib_save_LIBS=$LIBS
test ! -s conftest.err
} && test -s conftest$ac_exeext &&
$as_test_x conftest$ac_exeext; then
- ac_cv_lib_krb4_main=yes
+ eval "$as_ac_Lib=yes"
else
echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5
- ac_cv_lib_krb4_main=no
+ eval "$as_ac_Lib=no"
fi
rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
- { echo "$as_me:$LINENO: result: $ac_cv_lib_krb4_main" >&5
- echo "${ECHO_T}$ac_cv_lib_krb4_main" >&6; }
- if test $ac_cv_lib_krb4_main = yes; then
+ ac_res=`eval echo '${'$as_ac_Lib'}'`
+ { echo "$as_me:$LINENO: result: $ac_res" >&5
+ echo "${ECHO_T}$ac_res" >&6; }
+ if test `eval echo '${'$as_ac_Lib'}'` = yes; then
K4LIBS="-lkrb4 $K4LIBS"
else
K4LIBS="-lkrb $K4LIBS"
done
- SUDO_LIBS="${SUDO_LIBS}${LDAP_LIBS}"
+ SUDO_LIBS="${SUDO_LIBS} ${LDAP_LIBS}"
LIBS="$_LIBS"
LDFLAGS="$_LDFLAGS"
# XXX - OpenLDAP has deprecated ldap_get_values()
# Cmnd alias specification
##
Cmnd_Alias DUMPS = /usr/sbin/dump, /usr/sbin/rdump, /usr/sbin/restore, \
- /usr/sbin/rrestore, /usr/bin/mt
-Cmnd_Alias KILL = /usr/bin/kill
+ /usr/sbin/rrestore, /bin/mt
+Cmnd_Alias KILL = /bin/kill
Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm
- Cmnd_Alias SHUTDOWN = /sbin/shutdown
- Cmnd_Alias HALT = /sbin/halt
- Cmnd_Alias REBOOT = /sbin/reboot
- Cmnd_Alias SHELLS = /sbin/sh, /bin/sh, /bin/csh, /usr/bin/ksh, \
- /usr/bin/tcsh, /usr/bin/rsh, \
- /usr/bin/zsh
- Cmnd_Alias SU = /bin/su
+ Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown
+ Cmnd_Alias HALT = /usr/sbin/halt
+ Cmnd_Alias REBOOT = /usr/sbin/reboot
+ Cmnd_Alias SHELLS = /sbin/sh, /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh, \
+ /usr/local/bin/tcsh, /usr/bin/rsh, \
+ /usr/local/bin/zsh
+ Cmnd_Alias SU = /usr/bin/su
Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, \
/usr/bin/chfn
sudoedit /etc/printcap, /usr/oper/bin/
# joe may su only to operator
-joe ALL = /usr/bin/su operator
+joe ALL = /bin/su operator
# pete may change passwords for anyone but root on the hp snakes
pete HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
# users in the secretaries netgroup need to help manage the printers
# as well as add and remove users
-+secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
++secretaries ALL = PRINTING, /usr/sbin/adduser, /usr/bin/rmuser
# fred can run commands as oracle or sybase without a password
fred ALL = (DB) NOPASSWD: ALL
# on the alphas, john may su to anyone but root and flags are not allowed
-john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
+john ALPHA = /bin/su [!-]*, !/bin/su *root*
# jen can run anything on all machines except the ones
# in the "SERVERS" Host_Alias
#include "version.h"
#ifndef lint
- __unused __unused static const char rcsid[] = "$Sudo: sudo.c,v 1.369.2.38 2008/03/05 19:34:49 millert Exp $";
+ __unused __unused static const char rcsid[] = "$Sudo: sudo.c,v 1.369.2.39 2008/04/10 17:56:05 millert Exp $";
#endif /* lint */
/*
/* Local sudoers file overrides LDAP if we have a match. */
v = sudoers_lookup(pwflag);
- if (ISSET(v, VALIDATE_OK))
+ if (validated == VALIDATE_ERROR || ISSET(v, VALIDATE_OK))
validated = v;
}
#else
* "host" is the (possibly fully-qualified) hostname and
* "shost" is the unqualified form of the hostname.
*/
+ sudo_user.host_fqdn_queried = FALSE;
nohostname = gethostname(thost, sizeof(thost));
if (nohostname)
user_host = user_shost = "localhost";
else {
user_host = estrdup(thost);
- if ((p = strchr(user_host, '.'))) {
- *p = '\0';
- user_shost = estrdup(user_host);
- *p = '.';
+ if (def_fqdn) {
+ /* Defer call to set_fqdn() until log_error() is safe. */
+ user_shost = user_host;
} else {
- if ((p = strchr(user_host, '.'))) {
- *p = '\0';
- user_shost = estrdup(user_host);
- *p = '.';
- } else {
- user_shost = user_host;
- }
+ user_shost = user_host;
}
}
if (nohostname)
log_error(USE_ERRNO|MSG_ONLY, "can't get hostname");
- /* We don't query FQDN yet, it might get disabled later. Querying is done
- * when host matching is executed and def_fqdn still true */
-
set_runaspw(*user_runas); /* may call log_error() */
if (*user_runas[0] == '#' && runas_pw->pw_name && runas_pw->pw_name[0])
*user_runas = estrdup(runas_pw->pw_name);
} else {
user_shost = user_host;
}
+ sudo_user.host_fqdn_queried = TRUE;
+}
+
++/*
++ * Get passwd entry for the user we are going to run commands as.
++ * By default, this is "root". Updates runas_pw as a side effect.
++ */
++int
++set_runaspw(user)
++ char *user;
++{
++ if (runas_pw != NULL) {
++ if (user_runas != &def_runas_default)
++ return(TRUE); /* don't override -u option */
++ efree(runas_pw);
++ }
++ if (*user == '#') {
++ runas_pw = sudo_getpwuid(atoi(user + 1));
++ if (runas_pw == NULL) {
++ runas_pw = emalloc(sizeof(struct passwd));
++ (void) memset((VOID *)runas_pw, 0, sizeof(struct passwd));
++ runas_pw->pw_uid = atoi(user + 1);
++ }
++ } else {
++ runas_pw = sudo_getpwnam(user);
++ if (runas_pw == NULL)
++ log_error(NO_MAIL|MSG_ONLY, "no passwd entry for %s!", user);
++ }
++ return(TRUE);
+ }
+
/*
* Get passwd entry for the user we are going to run commands as.
* By default, this is "root". Updates runas_pw as a side effect.
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 1
++=======
+ 1.6.9p16 May 8, 2008 1
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 2
++=======
+ 1.6.9p16 May 8, 2008 2
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 3
++=======
+ 1.6.9p16 May 8, 2008 3
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 4
++=======
+ 1.6.9p16 May 8, 2008 4
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 5
++=======
+ 1.6.9p16 May 8, 2008 5
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 6
++=======
+ 1.6.9p16 May 8, 2008 6
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 7
++=======
+ 1.6.9p16 May 8, 2008 7
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 8
++=======
+ 1.6.9p16 May 8, 2008 8
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
++<<<<<<< HEAD:sudo.cat
+1.6.9p15 March 23, 2008 9
++=======
+ 1.6.9p16 May 8, 2008 9
++>>>>>>> 17fe41bae8a65fb88683c9795414556ed9b636e9:sudo.cat
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\"
- .\" $Sudo: sudo.man.in,v 1.29.2.25 2008/03/23 19:43:51 millert Exp $
+ .\" $Sudo: sudo.man.in,v 1.29.2.26 2008/05/08 19:48:23 millert Exp $
.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.32
.\"
.\" Standard preamble:
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
- .\" double quote, and \*(R" will give a right double quote. \*(C+ will
- .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
- .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
- .\" nothing in troff, for use with C<>.
- .tr \(*W-
+ .\" double quote, and \*(R" will give a right double quote. | will give a
+ .\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to
+ .\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C'
+ .\" expand to `' in nroff, nothing in troff, for use with C<>.
+ .tr \(*W-|\(bv\*(Tr
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
.\" ========================================================================
.\"
.IX Title "SUDO @mansectsu@"
- .TH SUDO @mansectsu@ "March 23, 2008" "1.6.9p15" "MAINTENANCE COMMANDS"
+ .TH SUDO @mansectsu@ "May 8, 2008" "1.6.9p16" "MAINTENANCE COMMANDS"
.SH "NAME"
sudo, sudoedit \- execute a command as another user
.SH "SYNOPSIS"
To prevent command spoofing, \fBsudo\fR checks \*(L".\*(R" and "" (both denoting
current directory) last when searching for a command in the user's
\&\s-1PATH\s0 (if one or both are in the \s-1PATH\s0). Note, however, that the
-actual \f(CW\*(C`PATH\*(C'\fR environment variable is \fInot\fR modified and is passed
-unchanged to the program that \fBsudo\fR executes.
+\&\f(CW\*(C`PATH\*(C'\fR environment variable is further modified in Debian because of
+the use of the \fI\s-1SECURE_PATH\s0\fR build option.
.PP
\&\fBsudo\fR will check the ownership of its timestamp directory
(\fI@timedir@\fR by default) and ignore the directory's contents if
file system holding ~yazza is not exported as root:
.PP
.Vb 1
-\& $ sudo -u yazza ls ~yazza
+\& $ sudo \-u yazza ls ~yazza
.Ve
.PP
To edit the \fIindex.html\fR file as user www:
.PP
.Vb 1
-\& $ sudo -u www vi ~www/htdocs/index.html
+\& $ sudo \-u www vi ~www/htdocs/index.html
.Ve
.PP
To shutdown a machine:
.PP
.Vb 1
-\& $ sudo shutdown -r +15 "quick reboot"
+\& $ sudo shutdown \-r +15 "quick reboot"
.Ve
.PP
To make a usage listing of the directories in the /home
to make the \f(CW\*(C`cd\*(C'\fR and file redirection work.
.PP
.Vb 1
-\& $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
+\& $ sudo sh \-c "cd /home ; du \-s * | sort \-rn > USAGE"
.Ve
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIgrep\fR\|(1), \fIsu\fR\|(1), \fIstat\fR\|(2),
@LCMAN@\&\fIlogin_cap\fR\|(3),
\&\fIpasswd\fR\|(@mansectform@), \fIsudoers\fR\|(5), \fIvisudo\fR\|(@mansectsu@)
+.PP
+The file /usr/share/doc/sudo/OPTIONS describes the options used for building
+the Debian version of sudo, some of which change default behaviors documented
+elsewhere in this document.
.SH "AUTHORS"
.IX Header "AUTHORS"
Many people have worked on \fBsudo\fR over the years; this
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\"
- .\" $Sudo: sudoers.man.in,v 1.45.2.27 2008/03/23 19:43:51 millert Exp $
+ .\" $Sudo: sudoers.man.in,v 1.45.2.28 2008/05/08 19:48:23 millert Exp $
.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.32
.\"
.\" Standard preamble:
.\" ========================================================================
.\"
.IX Title "SUDOERS @mansectform@"
- .TH SUDOERS @mansectform@ "March 23, 2008" "1.6.9p15" "MAINTENANCE COMMANDS"
+ .TH SUDOERS @mansectform@ "May 8, 2008" "1.6.9p16" "MAINTENANCE COMMANDS"
.SH "NAME"
sudoers \- list of which users may execute what
.SH "DESCRIPTION"
.el .IP "\f(CW%u\fR" 4
.IX Item "%u"
expanded to the invoking user's login name
+.ie n .IP "%p" 4
+.el .IP "\f(CW%p\fR" 4
+.IX Item "%p"
+expanded to the user whose password is asked for (respects the presence of the
+rootpw, targetpw or runaspw options in the configuration)
+
.ie n .IP "\*(C`%%\*(C'" 4
.el .IP "\f(CW\*(C`%%\*(C'\fR" 4
.IX Item "%%"
.IP "logfile" 12
.IX Item "logfile"
Path to the \fBsudo\fR log file (not the syslog log file). Setting a path
+turns on logging to a file; negating this option turns it off.
+By default, \fBsudo\fR logs via syslog.
+.IP "mailerflags" 12
+.IX Item "mailerflags"
+Flags to use when invoking mailer. Defaults to \fB\-t\fR.
+.IP "mailerpath" 12
+.IX Item "mailerpath"
+Path to mail program used to send warning mail.
+Defaults to the path to sendmail found at configure time.
+.IP "mailto" 12
+.IX Item "mailto"
+Address to send warning and error mail to. The address should
+be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR) to protect against \fBsudo\fR
+interpreting the \f(CW\*(C`@\*(C'\fR sign. Defaults to \f(CW\*(C`@mailto@\*(C'\fR.
+.IP "exempt_group" 12
+.IX Item "exempt_group"
+Users in this group are exempt from password and \s-1PATH\s0 requirements.
+On Debian systems, this is set to the group 'sudo' by default.
+.IP "syslog" 12
+.IX Item "syslog"
+Syslog facility if syslog is being used for logging (negate to
+disable syslog logging). Defaults to \f(CW\*(C`@logfac@\*(C'\fR.
+.IP "verifypw" 12
+.IX Item "verifypw"
+This option controls when a password will be required when a user runs
+\&\fBsudo\fR with the \fB\-v\fR flag. It has the following possible values:
+.RS 12
+.IP "all" 8
+.IX Item "all"
+All the user's \fIsudoers\fR entries for the current host must have
++the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
++.IP "always" 8
++.IX Item "always"
++The user must always enter a password to use the \fB\-l\fR flag.
++.IP "any" 8
++.IX Item "any"
++At least one of the user's \fIsudoers\fR entries for the current host
++must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
++.IP "never" 8
++.IX Item "never"
++The user need never enter a password to use the \fB\-l\fR flag.
++.RE
++.RS 12
++.Sp
++If no value is specified, a value of \fIany\fR is implied.
++Negating the option results in a value of \fInever\fR being used.
++The default value is \fIany\fR.
++.RE
++.IP "logfile" 12
++.IX Item "logfile"
++Path to the \fBsudo\fR log file (not the syslog log file). Setting a path
+ turns on logging to a file; negating this option turns it off.
+ By default, \fBsudo\fR logs via syslog.
+ .IP "mailerflags" 12
+ .IX Item "mailerflags"
+ Flags to use when invoking mailer. Defaults to \fB\-t\fR.
+ .IP "mailerpath" 12
+ .IX Item "mailerpath"
+ Path to mail program used to send warning mail.
+ Defaults to the path to sendmail found at configure time.
+ .IP "mailto" 12
+ .IX Item "mailto"
+ Address to send warning and error mail to. The address should
+ be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR) to protect against \fBsudo\fR
+ interpreting the \f(CW\*(C`@\*(C'\fR sign. Defaults to \f(CW\*(C`@mailto@\*(C'\fR.
+ .IP "syslog" 12
+ .IX Item "syslog"
+ Syslog facility if syslog is being used for logging (negate to
+ disable syslog logging). Defaults to \f(CW\*(C`@logfac@\*(C'\fR.
+ .IP "verifypw" 12
+ .IX Item "verifypw"
+ This option controls when a password will be required when a user runs
+ \&\fBsudo\fR with the \fB\-v\fR flag. It has the following possible values:
+ .RS 12
+ .IP "all" 8
+ .IX Item "all"
+ All the user's \fIsudoers\fR entries for the current host must have
the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
.IP "always" 8
.IX Item "always"
Cmnd_Alias ::= NAME '=' Cmnd_List
- NAME ::= [A-Z]([A-Z][0-9]_)*
+ NAME ::= [A-Z]([a-z][A-Z][0-9]_)*
Each I<alias> definition is of the form
=over 16
--=item always_set_home
++=item mail_badpass
--If set, B<sudo> will set the C<HOME> environment variable to the home
--directory of the target user (which is root unless the B<-u> option is used).
--This effectively means that the B<-H> flag is always implied.
--This flag is I<off> by default.
++Send mail to the I<mailto> user if the user running B<sudo> does not
++enter the correct password. This flag is I<off> by default.
++
++=item mail_no_host
++
++If set, mail will be sent to the I<mailto> user if the invoking
++user exists in the I<sudoers> file, but is not allowed to run
++commands on the current host. This flag is I<@mail_no_host@> by default.
++
++=item mail_no_perms
++
++If set, mail will be sent to the I<mailto> user if the invoking
++user is allowed to use B<sudo> but the command they are trying is not
++listed in their I<sudoers> file entry or is explicitly denied.
++This flag is I<@mail_no_perms@> by default.
++
++=item mail_no_user
++
++If set, mail will be sent to the I<mailto> user if the invoking
++user is not in the I<sudoers> file. This flag is I<@mail_no_user@>
++by default.
++
++=item noexec
++
++If set, all commands run via B<sudo> will behave as if the C<NOEXEC>
++tag has been set, unless overridden by a C<EXEC> tag. See the
++description of I<NOEXEC and EXEC> below as well as the L<PREVENTING SHELL
++ESCAPES> section at the end of this manual. This flag is I<off> by default.
=item authenticate
I<sudoers> file. I.e., instead of myhost you would use myhost.mydomain.edu.
You may still use the short form if you wish (and even mix the two).
Beware that turning on I<fqdn> requires B<sudo> to make DNS lookups
- which may make affect B<sudo> performance if DNS stops working (for example
- if the machine is not plugged into the network). The default behavior for
- Debian has been modified to minimize the potential of a problem, but there
- may still be some cases in which lack of working DNS might make sudo work
- very slowly. Also note that
+ which may make B<sudo> unusable if DNS stops working (for example
+ if the machine is not plugged into the network). Also note that
you must use the host's official name as DNS knows it. That is,
you may not use a host alias (C<CNAME> entry) due to performance
issues and the fact that there is no way to get all aliases from
=item env_check
- Like I<env_keep>, but listed environment variables are taken from the user's environment if
- the variable's value does B<not> contain C<%> or C</> characters. This can
+ Environment variables to be removed from the user's environment if
+ the variable's value contains C<%> or C</> characters. This can
be used to guard against printf-style format vulnerabilities in
poorly-written programs. The argument may be a double-quoted,
space-separated list or a single value without double-quotes. The
=item env_delete
-Environment variables to be removed from the user's environment.
+
+Not effective due to security issues: only variables listed in
+I<env_keep> or I<env_check> can be passed through B<sudo>!
+
The argument may be a double-quoted, space-separated list or a
single value without double-quotes. The list can be replaced, added
to, deleted from, or disabled by using the C<=>, C<+=>, C<-=>, and
=item env_keep
-Environment variables to be preserved in the user's environment
-when the I<env_reset> option is in effect. This allows fine-grained
+Environment variables to be preserved in the user's environment.
+This allows fine-grained
control over the environment B<sudo>-spawned processes will receive.
The argument may be a double-quoted, space-separated list or a
single value without double-quotes. The list can be replaced, added
the C<Host_Alias>, C<User_Alias>, and C<Cmnd_Alias> specifications
come first, followed by any C<Default_Entry> lines, and finally the
C<Runas_Alias> and user specifications. The basic rule of thumb
- is that you cannot reference an Alias that has not already been defined.
+ is you cannot reference an Alias that has not already been defined.
+
+ Below are example I<sudoers> entries. Admittedly, some of
+ these are a bit contrived. First, we define our I<aliases>:
+Below are example I<sudoers> entries. Admittedly, some of
+these are a bit contrived. First, we allow a few environment
+variables to pass and then define our I<aliases>:
+
+ # Run X applications through sudo; HOME is used to find .Xauthority file
+ # Note that some programs may use HOME for other purposes too and
+ # this may lead to privilege escalation!
+ Defaults env_keep = "DISPLAY HOME"
+
# User alias specification
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
.\" Agency (DARPA) and Air Force Research Laboratory, Air Force
.\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
.\"
- .\" $Sudo: visudo.man.in,v 1.20.2.20 2008/03/23 19:43:51 millert Exp $
+ .\" $Sudo: visudo.man.in,v 1.20.2.21 2008/05/08 19:48:24 millert Exp $
.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.32
.\"
.\" Standard preamble:
.\" ========================================================================
.\"
.IX Title "VISUDO @mansectsu@"
- .TH VISUDO @mansectsu@ "March 23, 2008" "1.6.9p15" "MAINTENANCE COMMANDS"
+ .TH VISUDO @mansectsu@ "May 8, 2008" "1.6.9p16" "MAINTENANCE COMMANDS"
.SH "NAME"
visudo \- edit the sudoers file
.SH "SYNOPSIS"
.PP
There is a hard-coded list of editors that \fBvisudo\fR will use set
at compile-time that may be overridden via the \fIeditor\fR \fIsudoers\fR
-\&\f(CW\*(C`Default\*(C'\fR variable. This list defaults to the path to \fIvi\fR\|(1) on
-your system, as determined by the \fIconfigure\fR script. Normally,
-\&\fBvisudo\fR does not honor the \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR environment
+\&\f(CW\*(C`Default\*(C'\fR variable.
+On Debian systems, this list defaults to /usr/bin/editor, which is meant to
+be a system-wide default editor chosen through the alternatives system.
+Normally, \&\fBvisudo\fR does not honor the \f(CW\*(C`VISUAL\*(C'\fR or
+\f(CW\*(C`EDITOR\*(C'\fR environment
variables unless they contain an editor in the aforementioned editors
list. However, if \fBvisudo\fR is configured with the \fI\-\-with\-enveditor\fR
flag or the \fIenv_editor\fR \f(CW\*(C`Default\*(C'\fR variable is set in \fIsudoers\fR,
\&\fBvisudo\fR will use any the editor defines by \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR.
Note that this can be a security hole since it allows the user to
execute any program they wish simply by setting \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR.
+Despite this potential risk, sudo on Debian is compiled with the
+\fI\-\-with\-enveditor\fR flag.
.PP
\&\fBvisudo\fR parses the \fIsudoers\fR file after the edit and will
not save the changes if there is a syntax error. Upon finding
projects / debian / sudo / commitdiff