mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-22 18:08:23 +00:00
Code Issues Releases Wiki Activity

Update copyright year and regen man pages.

Browse Source
This commit is contained in:
Todd C. Miller 2018-04-15 16:43:06 -06:00
parent 9de8a0bd05
commit 43ea752ded
10 changed files with 118 additions and 118 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
doc/sudo.conf.man.in
View File

@ -79,7 +79,7 @@ are silently ignored.
The The
\fBsudo.conf\fR \fBsudo.conf\fR
file is always parsed in the file is always parsed in the
\(Lq\fRC\fR\(Rq \(lq\fRC\fR\(rq
locale. locale.
.SS "Plugin configuration" .SS "Plugin configuration"
\fBsudo\fR \fBsudo\fR
@ -316,7 +316,7 @@ sensitive information.
To aid in debugging To aid in debugging
\fBsudo\fR \fBsudo\fR
crashes, you may wish to re-enable core dumps by setting crashes, you may wish to re-enable core dumps by setting
\(Lqdisable_coredump\(Rq \(lqdisable_coredump\(rq
to false in to false in
\fBsudo.conf\fR \fBsudo.conf\fR
as follows: as follows:
@ -386,7 +386,7 @@ Use the static group list that the kernel returns.
Retrieving the group list this way is very fast but it is subject Retrieving the group list this way is very fast but it is subject
to an upper limit as described above. to an upper limit as described above.
It is It is
\(Lqstatic\(Rq \(lqstatic\(rq
in that it does not reflect changes to the group database made in that it does not reflect changes to the group database made
after the user logs in. after the user logs in.
This was the default behavior prior to This was the default behavior prior to
@ -396,7 +396,7 @@ This was the default behavior prior to
dynamic dynamic
Always query the group database directly. Always query the group database directly.
It is It is
\(Lqdynamic\(Rq \(lqdynamic\(rq
in that changes made to the group database after the user logs in in that changes made to the group database after the user logs in
will be reflected in the group list. will be reflected in the group list.
On some systems, querying the group database for all of a user's On some systems, querying the group database for all of a user's
@ -738,7 +738,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

14
doc/sudo.man.in
View File

@ -1,7 +1,7 @@
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER! .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
.\" IT IS GENERATED AUTOMATICALLY FROM sudo.mdoc.in .\" IT IS GENERATED AUTOMATICALLY FROM sudo.mdoc.in
.\" .\"
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2017 .\" Copyright (c) 1994-1996, 1998-2005, 2007-2018
.\" Todd C. Miller <Todd.Miller@sudo.ws> .\" Todd C. Miller <Todd.Miller@sudo.ws>
.\" .\"
.\" Permission to use, copy, modify, and distribute this software for any .\" Permission to use, copy, modify, and distribute this software for any
@ -198,7 +198,7 @@ when validating the user, if allowed by
\fI/etc/login.conf\fR. \fI/etc/login.conf\fR.
The system administrator may specify a list of sudo-specific The system administrator may specify a list of sudo-specific
authentication methods by adding an authentication methods by adding an
\(Lqauth-sudo\(Rq \(lqauth-sudo\(rq
entry in entry in
\fI/etc/login.conf\fR. \fI/etc/login.conf\fR.
This option is only available on systems that support BSD authentication. This option is only available on systems that support BSD authentication.
@ -728,7 +728,7 @@ can run a command.
.PP .PP
If an I/O logging plugin is configured or if the security policy If an I/O logging plugin is configured or if the security policy
explicitly requests it, a new pseudo-terminal explicitly requests it, a new pseudo-terminal
(\(Lqpty\(Rq) (\(lqpty\(rq)
is allocated and is allocated and
fork(2) fork(2)
is used to create a second is used to create a second
@ -749,7 +749,7 @@ exists to relay job control signals between the user's
existing terminal and the pty the command is being run in. existing terminal and the pty the command is being run in.
This makes it possible to suspend and resume the command. This makes it possible to suspend and resume the command.
Without the monitor, the command would be in what POSIX terms an Without the monitor, the command would be in what POSIX terms an
\(Lqorphaned process group\(Rq \(lqorphaned process group\(rq
and it would not receive any job control signals from the kernel. and it would not receive any job control signals from the kernel.
When the command exits or is terminated by a signal, the When the command exits or is terminated by a signal, the
\fImonitor\fR \fImonitor\fR
@ -928,7 +928,7 @@ This should not happen under normal circumstances.
The most common reason for The most common reason for
stat(2) stat(2)
to return to return
\(Lqpermission denied\(Rq \(lqpermission denied\(rq
is if you are running an automounter and one of the directories in is if you are running an automounter and one of the directories in
your your
\fRPATH\fR \fRPATH\fR
@ -993,7 +993,7 @@ systems allowed setuid processes to dump core by default.
To aid in debugging To aid in debugging
\fBsudo\fR \fBsudo\fR
crashes, you may wish to re-enable core dumps by setting crashes, you may wish to re-enable core dumps by setting
\(Lqdisable_coredump\(Rq \(lqdisable_coredump\(rq
to false in the to false in the
sudo.conf(@mansectform@) sudo.conf(@mansectform@)
file as follows: file as follows:
@ -1280,7 +1280,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

2
doc/sudo.mdoc.in
View File

@ -1,5 +1,5 @@
.\" .\"
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2017 .\" Copyright (c) 1994-1996, 1998-2005, 2007-2018
.\" Todd C. Miller <Todd.Miller@sudo.ws> .\" Todd C. Miller <Todd.Miller@sudo.ws>
.\" .\"
.\" Permission to use, copy, modify, and distribute this software for any .\" Permission to use, copy, modify, and distribute this software for any

40
doc/sudo_plugin.man.in
View File

@ -1,7 +1,7 @@
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER! .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
.\" IT IS GENERATED AUTOMATICALLY FROM sudo_plugin.mdoc.in .\" IT IS GENERATED AUTOMATICALLY FROM sudo_plugin.mdoc.in
.\" .\"
.\" Copyright (c) 2009-2017 Todd C. Miller <Todd.Miller@sudo.ws> .\" Copyright (c) 2009-2018 Todd C. Miller <Todd.Miller@sudo.ws>
.\" .\"
.\" Permission to use, copy, modify, and distribute this software for any .\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above .\" purpose with or without fee is hereby granted, provided that the above
@ -160,7 +160,7 @@ settings
A vector of user-supplied A vector of user-supplied
\fBsudo\fR \fBsudo\fR
settings in the form of settings in the form of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
The vector is terminated by a The vector is terminated by a
\fRNULL\fR \fRNULL\fR
@ -290,9 +290,9 @@ sudo.conf(@mansectform@).
network_addrs=list network_addrs=list
A space-separated list of IP network addresses and netmasks in the A space-separated list of IP network addresses and netmasks in the
form form
\(Lqaddr/netmask\(Rq, \(lqaddr/netmask\(rq,
e.g.\& e.g.\&
\(Lq192.168.1.2/255.255.255.0\(Rq. \(lq192.168.1.2/255.255.255.0\(rq.
The address and netmask pairs may be either IPv4 or IPv6, depending on The address and netmask pairs may be either IPv4 or IPv6, depending on
what the operating system supports. what the operating system supports.
If the address contains a colon If the address contains a colon
@ -339,9 +339,9 @@ based on the runas user.
.TP 6n .TP 6n
progname=string progname=string
The command name that sudo was run as, typically The command name that sudo was run as, typically
\(Lqsudo\(Rq \(lqsudo\(rq
or or
\(Lqsudoedit\(Rq. \(lqsudoedit\(rq.
.TP 6n .TP 6n
prompt=string prompt=string
The prompt to use when requesting a password, if specified via The prompt to use when requesting a password, if specified via
@ -425,7 +425,7 @@ silently ignore settings that it does not recognize.
.TP 6n .TP 6n
user_info user_info
A vector of information about the user running the command in the form of A vector of information about the user running the command in the form of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
The vector is terminated by a The vector is terminated by a
\fRNULL\fR \fRNULL\fR
@ -546,7 +546,7 @@ tty=string
The path to the user's terminal device. The path to the user's terminal device.
If the user has no terminal device associated with the session, If the user has no terminal device associated with the session,
the value will be empty, as in the value will be empty, as in
\(Lq\fRtty=\fR\(Rq. \(lq\fRtty=\fR\(rq.
.TP 6n .TP 6n
uid=uid_t uid=uid_t
The real user ID of the user invoking The real user ID of the user invoking
@ -567,7 +567,7 @@ The name of the user invoking
user_env user_env
The user's environment in the form of a The user's environment in the form of a
\fRNULL\fR-terminated vector of \fRNULL\fR-terminated vector of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
.sp .sp
When parsing When parsing
@ -720,10 +720,10 @@ into
\fIargv_out\fR, \fIargv_out\fR,
separated from the separated from the
editor and its arguments by a editor and its arguments by a
\(Lq\fR--\fR\(Rq \(lq\fR--\fR\(rq
element. element.
The The
\(Lq\fR--\fR\(Rq \(lq\fR--\fR\(rq
will will
be removed by be removed by
\fBsudo\fR \fBsudo\fR
@ -776,7 +776,7 @@ Additional environment variables specified by the user on the command
line in the form of a line in the form of a
\fRNULL\fR-terminated \fRNULL\fR-terminated
vector of vector of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
The plugin may reject the command if one or more variables The plugin may reject the command if one or more variables
are not allowed to be set, or it may silently ignore such variables. are not allowed to be set, or it may silently ignore such variables.
@ -796,7 +796,7 @@ might.
.TP 6n .TP 6n
command_info command_info
Information about the command being run in the form of Information about the command being run in the form of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
These values are used by These values are used by
\fBsudo\fR \fBsudo\fR
@ -1282,7 +1282,7 @@ argument points to the environment the command will
run in, in the form of a run in, in the form of a
\fRNULL\fR-terminated \fRNULL\fR-terminated
vector of vector of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
This is the same string passed back to the front end via This is the same string passed back to the front end via
the Policy Plugin's the Policy Plugin's
@ -1620,7 +1620,7 @@ settings
A vector of user-supplied A vector of user-supplied
\fBsudo\fR \fBsudo\fR
settings in the form of settings in the form of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
The vector is terminated by a The vector is terminated by a
\fRNULL\fR \fRNULL\fR
@ -1649,7 +1649,7 @@ section for a list of all possible settings.
.TP 6n .TP 6n
user_info user_info
A vector of information about the user running the command in the form of A vector of information about the user running the command in the form of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
The vector is terminated by a The vector is terminated by a
\fRNULL\fR \fRNULL\fR
@ -1691,7 +1691,7 @@ user_env
The user's environment in the form of a The user's environment in the form of a
\fRNULL\fR-terminated \fRNULL\fR-terminated
vector of vector of
\(Lqname=value\(Rq \(lqname=value\(rq
strings. strings.
.sp .sp
When parsing When parsing
@ -2297,11 +2297,11 @@ to the policy plugin.
A plugin may also accept a A plugin may also accept a
\fIrunas_user\fR \fIrunas_user\fR
in the form of in the form of
\(Lquser@hostname\(Rq \(lquser@hostname\(rq
which will work with older versions of which will work with older versions of
\fBsudo\fR. \fBsudo\fR.
It is anticipated that remote commands will be supported by executing a It is anticipated that remote commands will be supported by executing a
\(Lqhelper\(Rq \(lqhelper\(rq
program. program.
The policy plugin should setup the execution environment such that the The policy plugin should setup the execution environment such that the
\fBsudo\fR \fBsudo\fR
@ -2847,7 +2847,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

2
doc/sudo_plugin.mdoc.in
View File

@ -1,5 +1,5 @@
.\" .\"
.\" Copyright (c) 2009-2017 Todd C. Miller <Todd.Miller@sudo.ws> .\" Copyright (c) 2009-2018 Todd C. Miller <Todd.Miller@sudo.ws>
.\" .\"
.\" Permission to use, copy, modify, and distribute this software for any .\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above .\" purpose with or without fee is hereby granted, provided that the above

16
doc/sudoers.ldap.man.in
View File

@ -161,7 +161,7 @@ If a command name is preceded by an exclamation point,
the user will be prohibited from running that command. the user will be prohibited from running that command.
.sp .sp
The built-in command The built-in command
\(Lq\fRsudoedit\fR\(Rq \(lq\fRsudoedit\fR\(rq
is used to permit a user to run is used to permit a user to run
\fBsudo\fR \fBsudo\fR
with the with the
@ -170,7 +170,7 @@ option (or as
\fBsudoedit\fR). \fBsudoedit\fR).
It may take command line arguments just as a normal command does. It may take command line arguments just as a normal command does.
Note that Note that
\(Lq\fRsudoedit\fR\(Rq \(lq\fRsudoedit\fR\(rq
is a command built into is a command built into
\fBsudo\fR \fBsudo\fR
itself and must be specified in without a leading path. itself and must be specified in without a leading path.
@ -321,7 +321,7 @@ If multiple entries match, the entry with the highest
\fRsudoOrder\fR \fRsudoOrder\fR
attribute is chosen. attribute is chosen.
This corresponds to the This corresponds to the
\(Lqlast match\(Rq \(lqlast match\(rq
behavior of the sudoers file. behavior of the sudoers file.
If the If the
\fRsudoOrder\fR \fRsudoOrder\fR
@ -625,7 +625,7 @@ sudoOption: !authenticate
.fi .fi
.PP .PP
This assumes that users john and sally are members of the This assumes that users john and sally are members of the
\(Lqadmins\(Rq \(lqadmins\(rq
Unix group. Unix group.
.SS "Sudoers schema" .SS "Sudoers schema"
In order to use In order to use
@ -725,7 +725,7 @@ parameter.
The The
\fIsecret\fR \fIsecret\fR
may be a plain text password or a base64-encoded string with a may be a plain text password or a base64-encoded string with a
\(Lqbase64:\(Rq \(lqbase64:\(rq
prefix. prefix.
For example: For example:
.nf .nf
@ -954,7 +954,7 @@ parameter is deprecated and will be removed in a future release.
The same information is now logged via the The same information is now logged via the
\fBsudo\fR \fBsudo\fR
debugging framework using the debugging framework using the
\(Lqldap\(Rq \(lqldap\(rq
subsystem at priorities subsystem at priorities
\fIdiag\fR \fIdiag\fR
and and
@ -1116,7 +1116,7 @@ using the Tivoli Directory Server LDAP library.
The The
\fIsecret\fR \fIsecret\fR
may be a plain text password or a base64-encoded string with a may be a plain text password or a base64-encoded string with a
\(Lqbase64:\(Rq \(lqbase64:\(rq
prefix. prefix.
For example: For example:
.nf .nf
@ -1633,7 +1633,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

130
doc/sudoers.man.in
View File

@ -386,7 +386,7 @@ env_keep += "BASH_FUNC_my_func%%=()*"
.fi .fi
.PP .PP
Without the Without the
\(Lq\fR=()*\fR\(Rq \(lq\fR=()*\fR\(rq
suffix, this would not match, as suffix, this would not match, as
\fBbash\fR \fBbash\fR
shell functions are not preserved by default. shell functions are not preserved by default.
@ -394,7 +394,7 @@ shell functions are not preserved by default.
The complete list of environment variables that The complete list of environment variables that
\fBsudo\fR \fBsudo\fR
allows or denies is contained in the output of allows or denies is contained in the output of
\(Lq\fRsudo -V\fR\(Rq \(lq\fRsudo -V\fR\(rq
when run as root. when run as root.
Please note that this list varies based on the operating system Please note that this list varies based on the operating system
\fBsudo\fR \fBsudo\fR
@ -535,7 +535,7 @@ EBNF also contains the following
operators, which many readers will recognize from regular operators, which many readers will recognize from regular
expressions. expressions.
Do not, however, confuse them with Do not, however, confuse them with
\(Lqwildcard\(Rq \(lqwildcard\(rq
characters, which have different meanings. characters, which have different meanings.
.TP 6n .TP 6n
\fR\&?\fR \fR\&?\fR
@ -799,7 +799,7 @@ Note that
only inspects actual network interfaces; this means that IP address only inspects actual network interfaces; this means that IP address
127.0.0.1 (localhost) will never match. 127.0.0.1 (localhost) will never match.
Also, the host name Also, the host name
\(Lqlocalhost\(Rq \(lqlocalhost\(rq
will only match if that is the actual host name, which is usually will only match if that is the actual host name, which is usually
only the case for non-networked systems. only the case for non-networked systems.
.nf .nf
@ -867,7 +867,7 @@ if they are used in command arguments:
\(oq=\&\(cq, \(oq=\&\(cq,
\(oq\e\(cq. \(oq\e\(cq.
The built-in command The built-in command
\(Lq\fRsudoedit\fR\(Rq \(lq\fRsudoedit\fR\(rq
is used to permit a user to run is used to permit a user to run
\fBsudo\fR \fBsudo\fR
with the with the
@ -876,7 +876,7 @@ option (or as
\fBsudoedit\fR). \fBsudoedit\fR).
It may take command line arguments just as a normal command does. It may take command line arguments just as a normal command does.
Note that Note that
\(Lq\fRsudoedit\fR\(Rq \(lq\fRsudoedit\fR\(rq
is a command built into is a command built into
\fBsudo\fR \fBsudo\fR
itself and must be specified in the itself and must be specified in the
@ -1044,7 +1044,7 @@ run as
but this can be changed on a per-command basis. but this can be changed on a per-command basis.
.PP .PP
The basic structure of a user specification is The basic structure of a user specification is
\(Lqwho where = (as_whom) what\(Rq. \(lqwho where = (as_whom) what\(rq.
Let's break that down into its constituent parts: Let's break that down into its constituent parts:
.SS "Runas_Spec" .SS "Runas_Spec"
A A
@ -1271,7 +1271,7 @@ $ ppriv -l
.fi .fi
.PP .PP
In addition, there are several In addition, there are several
\(Lqspecial\(Rq \(lqspecial\(rq
privilege strings: privilege strings:
.TP 10n .TP 10n
none none
@ -1556,10 +1556,10 @@ By default, if the
\fRNOPASSWD\fR \fRNOPASSWD\fR
tag is applied to any of the entries for a user on the current host, tag is applied to any of the entries for a user on the current host,
he or she will be able to run he or she will be able to run
\(Lq\fRsudo -l\fR\(Rq \(lq\fRsudo -l\fR\(rq
without a password. without a password.
Additionally, a user may only run Additionally, a user may only run
\(Lq\fRsudo -v\fR\(Rq \(lq\fRsudo -v\fR\(rq
without a password if the without a password if the
\fRNOPASSWD\fR \fRNOPASSWD\fR
tag is present for all a user's entries that pertain to the current host. tag is present for all a user's entries that pertain to the current host.
@ -1609,7 +1609,7 @@ glob(3)
and and
fnmatch(3) fnmatch(3)
functions as specified by functions as specified by
IEEE Std 1003.1 (\(LqPOSIX.1\(Rq). IEEE Std 1003.1 (\(lqPOSIX.1\(rq).
.TP 10n .TP 10n
\fR*\fR \fR*\fR
Matches any set of zero or more characters (including white space). Matches any set of zero or more characters (including white space).
@ -1812,7 +1812,7 @@ The file name may also include the
\fR%h\fR \fR%h\fR
escape, signifying the short form of the host name. escape, signifying the short form of the host name.
In other words, if the machine's host name is In other words, if the machine's host name is
\(Lqxerxes\(Rq, \(lqxerxes\(rq,
then then
.nf .nf
.sp .sp
@ -1945,7 +1945,7 @@ is omitted, as in:
.PP .PP
it would explicitly deny root but not match any other users. it would explicitly deny root but not match any other users.
This is different from a true This is different from a true
\(Lqnegation\(Rq \(lqnegation\(rq
operator. operator.
.PP .PP
Note, however, that using a Note, however, that using a
@ -1953,7 +1953,7 @@ Note, however, that using a
in conjunction with the built-in in conjunction with the built-in
\fBALL\fR \fBALL\fR
alias to allow a user to run alias to allow a user to run
\(Lqall but a few\(Rq \(lqall but a few\(rq
commands rarely works as intended (see commands rarely works as intended (see
\fISECURITY NOTES\fR \fISECURITY NOTES\fR
below). below).
@ -2279,7 +2279,7 @@ command) does not contain the domain name.
In other words, instead of myhost you would use myhost.mydomain.edu. In other words, instead of myhost you would use myhost.mydomain.edu.
You may still use the short form if you wish (and even mix the two). You may still use the short form if you wish (and even mix the two).
This option is only effective when the This option is only effective when the
\(Lqcanonical\(Rq \(lqcanonical\(rq
host name, as returned by the host name, as returned by the
\fBgetaddrinfo\fR() \fBgetaddrinfo\fR()
or or
@ -2291,7 +2291,7 @@ for host name resolution.
If the system is configured to use the If the system is configured to use the
\fI/etc/hosts\fR \fI/etc/hosts\fR
file in preference to DNS, the file in preference to DNS, the
\(Lqcanonical\(Rq \(lqcanonical\(rq
host name may not be fully-qualified. host name may not be fully-qualified.
The order that sources are queried for host name resolution The order that sources are queried for host name resolution
is usually specified in the is usually specified in the
@ -2304,13 +2304,13 @@ file.
In the In the
\fI/etc/hosts\fR \fI/etc/hosts\fR
file, the first host name of the entry is considered to be the file, the first host name of the entry is considered to be the
\(Lqcanonical\(Rq \(lqcanonical\(rq
name; subsequent names are aliases that are not used by name; subsequent names are aliases that are not used by
\fBsudoers\fR. \fBsudoers\fR.
For example, the following hosts file line for the machine For example, the following hosts file line for the machine
\(Lqxyzzy\(Rq \(lqxyzzy\(rq
has the fully-qualified domain name as the has the fully-qualified domain name as the
\(Lqcanonical\(Rq \(lqcanonical\(rq
host name, and the short version as an alias. host name, and the short version as an alias.
.sp .sp
.RS 24n .RS 24n
@ -2331,7 +2331,7 @@ to make DNS lookups which renders
unusable if DNS stops working (for example if the machine is disconnected unusable if DNS stops working (for example if the machine is disconnected
from the network). from the network).
Also note that just like with the hosts file, you must use the Also note that just like with the hosts file, you must use the
\(Lqcanonical\(Rq \(lqcanonical\(rq
name as DNS knows it. name as DNS knows it.
That is, you may not use a host alias That is, you may not use a host alias
(\fRCNAME\fR (\fRCNAME\fR
@ -2791,10 +2791,10 @@ If set, root is allowed to run
\fBsudo\fR \fBsudo\fR
too. too.
Disabling this prevents users from Disabling this prevents users from
\(Lqchaining\(Rq \(lqchaining\(rq
\fBsudo\fR \fBsudo\fR
commands to get a root shell by doing something like commands to get a root shell by doing something like
\(Lq\fRsudo sudo /bin/sh\fR\(Rq. \(lq\fRsudo sudo /bin/sh\fR\(rq.
Note, however, that turning off Note, however, that turning off
\fIroot_sudo\fR \fIroot_sudo\fR
will also prevent root from running will also prevent root from running
@ -3159,7 +3159,7 @@ flag is set,
\fBsudo\fR \fBsudo\fR
will prompt for a password even when it would be visible on the screen. will prompt for a password even when it would be visible on the screen.
This makes it possible to run things like This makes it possible to run things like
\(Lq\fRssh somehost sudo ls\fR\(Rq \(lq\fRssh somehost sudo ls\fR\(rq
since by default, since by default,
ssh(1) ssh(1)
does does
@ -3193,25 +3193,25 @@ This setting is only supported by version 1.8.20 or higher.
.TP 18n .TP 18n
maxseq maxseq
The maximum sequence number that will be substituted for the The maximum sequence number that will be substituted for the
\(Lq\fR%{seq}\fR\(Rq \(lq\fR%{seq}\fR\(rq
escape in the I/O log file (see the escape in the I/O log file (see the
\fIiolog_dir\fR \fIiolog_dir\fR
description above for more information). description above for more information).
While the value substituted for While the value substituted for
\(Lq\fR%{seq}\fR\(Rq \(lq\fR%{seq}\fR\(rq
is in base 36, is in base 36,
\fImaxseq\fR \fImaxseq\fR
itself should be expressed in decimal. itself should be expressed in decimal.
Values larger than 2176782336 (which corresponds to the Values larger than 2176782336 (which corresponds to the
base 36 sequence number base 36 sequence number
\(LqZZZZZZ\(Rq) \(lqZZZZZZ\(rq)
will be silently truncated to 2176782336. will be silently truncated to 2176782336.
The default value is 2176782336. The default value is 2176782336.
.sp .sp
Once the local sequence number reaches the value of Once the local sequence number reaches the value of
\fImaxseq\fR, \fImaxseq\fR,
it will it will
\(Lqroll over\(Rq \(lqroll over\(rq
to zero, after which to zero, after which
\fBsudoers\fR \fBsudoers\fR
will truncate and re-use any existing I/O log path names. will truncate and re-use any existing I/O log path names.
@ -3242,7 +3242,7 @@ will split up log messages that are larger than
\fIsyslog_maxlen\fR \fIsyslog_maxlen\fR
bytes. bytes.
When a message is split, additional parts will include the string When a message is split, additional parts will include the string
\(Lq(command continued)\(Rq \(lq(command continued)\(rq
after the user name and before the continued command line arguments. after the user name and before the continued command line arguments.
.sp .sp
This setting is only supported by version 1.8.19 or higher. This setting is only supported by version 1.8.19 or higher.
@ -3287,9 +3287,9 @@ If set to a value less than
\fR0\fR \fR0\fR
the user's time stamp will not expire until the system is rebooted. the user's time stamp will not expire until the system is rebooted.
This can be used to allow users to create or delete their own time stamps via This can be used to allow users to create or delete their own time stamps via
\(Lq\fRsudo -v\fR\(Rq \(lq\fRsudo -v\fR\(rq
and and
\(Lq\fRsudo -k\fR\(Rq \(lq\fRsudo -k\fR\(rq
respectively. respectively.
.TP 18n .TP 18n
umask umask
@ -3424,7 +3424,7 @@ Note that
\fIiolog_file\fR \fIiolog_file\fR
may contain directory components. may contain directory components.
The default is The default is
\(Lq\fR%{seq}\fR\(Rq. \(lq\fR%{seq}\fR\(rq.
.sp .sp
See the See the
\fIiolog_dir\fR \fIiolog_dir\fR
@ -3545,7 +3545,7 @@ The escape
\fR%h\fR \fR%h\fR
will expand to the host name of the machine. will expand to the host name of the machine.
Default is Default is
\(Lq\fR@mailsub@\fR\(Rq. \(lq\fR@mailsub@\fR\(rq.
.TP 18n .TP 18n
noexec_file noexec_file
As of As of
@ -3562,7 +3562,7 @@ name used when the
\fB\-i\fR \fB\-i\fR
option is specified. option is specified.
The default value is The default value is
\(Lq\fR@pam_login_service@\fR\(Rq. \(lq\fR@pam_login_service@\fR\(rq.
See the description of See the description of
\fIpam_service\fR \fIpam_service\fR
for more information. for more information.
@ -3578,7 +3578,7 @@ file or a file in the
\fI/etc/pam.d\fR \fI/etc/pam.d\fR
directory. directory.
The default value is The default value is
\(Lq\fRsudo\fR\(Rq. \(lq\fRsudo\fR\(rq.
.sp .sp
This setting is only supported by version 1.8.8 or higher. This setting is only supported by version 1.8.8 or higher.
.TP 18n .TP 18n
@ -3631,9 +3631,9 @@ character
On systems that use PAM for authentication, On systems that use PAM for authentication,
\fIpassprompt\fR \fIpassprompt\fR
will only be used if the prompt provided by the PAM module matches the string will only be used if the prompt provided by the PAM module matches the string
\(LqPassword: \(Rq \(lqPassword: \(rq
or or
\(Lqusername's Password: \(Rq. \(lqusername's Password: \(rq.
This ensures that the This ensures that the
\fIpassprompt\fR \fIpassprompt\fR
setting does not interfere with challenge-response style authentication. setting does not interfere with challenge-response style authentication.
@ -3642,7 +3642,7 @@ The
flag can be used to change this behavior. flag can be used to change this behavior.
.sp .sp
The default value is The default value is
\(Lq\fR@passprompt@\fR\(Rq. \(lq\fR@passprompt@\fR\(rq.
.RE .RE
.TP 18n .TP 18n
privs privs
@ -3684,7 +3684,7 @@ Locale to use when parsing the sudoers file, logging commands, and
sending email. sending email.
Note that changing the locale may affect how sudoers is interpreted. Note that changing the locale may affect how sudoers is interpreted.
Defaults to Defaults to
\(Lq\fRC\fR\(Rq. \(lq\fRC\fR\(rq.
.TP 18n .TP 18n
timestamp_type timestamp_type
\fBsudoers\fR \fBsudoers\fR
@ -3781,9 +3781,9 @@ The
option specifies the fully qualified path to a file containing variables option specifies the fully qualified path to a file containing variables
to be set in the environment of the program being run. to be set in the environment of the program being run.
Entries in this file should either be of the form Entries in this file should either be of the form
\(Lq\fRVARIABLE=value\fR\(Rq \(lq\fRVARIABLE=value\fR\(rq
or or
\(Lq\fRexport VARIABLE=value\fR\(Rq. \(lq\fRexport VARIABLE=value\fR\(rq.
The value may optionally be surrounded by single or double quotes. The value may optionally be surrounded by single or double quotes.
Variables in this file are only added if the variable does not already Variables in this file are only added if the variable does not already
exist in the environment. exist in the environment.
@ -3977,7 +3977,7 @@ Defaults to the path to sendmail found at configure time.
.TP 14n .TP 14n
mailfrom mailfrom
Address to use for the Address to use for the
\(Lqfrom\(Rq \(lqfrom\(rq
address when sending warning and error mail. address when sending warning and error mail.
The address should be enclosed in double quotes The address should be enclosed in double quotes
(\&"") (\&"")
@ -4007,9 +4007,9 @@ The
option specifies the fully qualified path to a file containing variables option specifies the fully qualified path to a file containing variables
to be set in the environment of the program being run. to be set in the environment of the program being run.
Entries in this file should either be of the form Entries in this file should either be of the form
\(Lq\fRVARIABLE=value\fR\(Rq \(lq\fRVARIABLE=value\fR\(rq
or or
\(Lq\fRexport VARIABLE=value\fR\(Rq. \(lq\fRexport VARIABLE=value\fR\(rq.
The value may optionally be surrounded by single or double quotes. The value may optionally be surrounded by single or double quotes.
Variables in this file are only added if the variable does not already Variables in this file are only added if the variable does not already
exist in the environment. exist in the environment.
@ -4046,9 +4046,9 @@ to have a sane
\fRPATH\fR \fRPATH\fR
environment variable you may want to use this. environment variable you may want to use this.
Another use is if you want to have the Another use is if you want to have the
\(Lqroot path\(Rq \(lqroot path\(rq
be separate from the be separate from the
\(Lquser path\(Rq. \(lquser path\(rq.
Users in the group specified by the Users in the group specified by the
\fIexempt_group\fR \fIexempt_group\fR
option are not affected by option are not affected by
@ -4164,10 +4164,10 @@ The default value is
env_check env_check
Environment variables to be removed from the user's environment Environment variables to be removed from the user's environment
unless they are considered unless they are considered
\(Lqsafe\(Rq. \(lqsafe\(rq.
For all variables except For all variables except
\fRTZ\fR, \fRTZ\fR,
\(Lqsafe\(Rq \(lqsafe\(rq
means that the variable's value does not contain any means that the variable's value does not contain any
\(oq%\(cq \(oq%\(cq
or or
@ -4354,7 +4354,7 @@ Where the fields are as follows:
date date
The date the command was run. The date the command was run.
Typically, this is in the format Typically, this is in the format
\(LqMMM, DD, HH:MM:SS\(Rq. \(lqMMM, DD, HH:MM:SS\(rq.
If logging via If logging via
syslog(3), syslog(3),
the actual date format is controlled by the syslog daemon. the actual date format is controlled by the syslog daemon.
@ -4384,13 +4384,13 @@ The login name of the user who ran
.TP 14n .TP 14n
ttyname ttyname
The short name of the terminal (e.g.\& The short name of the terminal (e.g.\&
\(Lqconsole\(Rq, \(lqconsole\(rq,
\(Lqtty01\(Rq, \(lqtty01\(rq,
or or
\(Lqpts/0\(Rq) \(lqpts/0\(rq)
\fBsudo\fR \fBsudo\fR
was run on, or was run on, or
\(Lqunknown\(Rq \(lqunknown\(rq
if there was no terminal present. if there was no terminal present.
.TP 14n .TP 14n
cwd cwd
@ -4422,7 +4422,7 @@ The actual command that was executed.
Messages are logged using the locale specified by Messages are logged using the locale specified by
\fIsudoers_locale\fR, \fIsudoers_locale\fR,
which defaults to the which defaults to the
\(Lq\fRC\fR\(Rq \(lq\fRC\fR\(rq
locale. locale.
.SS "Denied command log entries" .SS "Denied command log entries"
If the user is not allowed to run the command, the reason for the denial If the user is not allowed to run the command, the reason for the denial
@ -4505,7 +4505,7 @@ file using group permissions to avoid this problem.
Consider either changing the ownership of Consider either changing the ownership of
\fI@sysconfdir@/sudoers\fR \fI@sysconfdir@/sudoers\fR
or adding an argument like or adding an argument like
\(Lqsudoers_uid=N\(Rq \(lqsudoers_uid=N\(rq
(where (where
\(oqN\(cq \(oqN\(cq
is the user ID that owns the is the user ID that owns the
@ -4534,7 +4534,7 @@ file has the wrong owner.
If you wish to change the If you wish to change the
\fIsudoers\fR \fIsudoers\fR
file owner, please add file owner, please add
\(Lqsudoers_uid=N\(Rq \(lqsudoers_uid=N\(rq
(where (where
\(oqN\(cq \(oqN\(cq
is the user ID that owns the is the user ID that owns the
@ -4555,7 +4555,7 @@ The
file must not be world-writable, the default file mode file must not be world-writable, the default file mode
is 0440 (readable by owner and group, writable by none). is 0440 (readable by owner and group, writable by none).
The default mode may be changed via the The default mode may be changed via the
\(Lqsudoers_mode\(Rq \(lqsudoers_mode\(rq
option to the option to the
\fBsudoers\fR \fBsudoers\fR
\fRPlugin\fR \fRPlugin\fR
@ -4570,7 +4570,7 @@ file has the wrong group ownership.
If you wish to change the If you wish to change the
\fIsudoers\fR \fIsudoers\fR
file group ownership, please add file group ownership, please add
\(Lqsudoers_gid=N\(Rq \(lqsudoers_gid=N\(rq
(where (where
\(oqN\(cq \(oqN\(cq
is the group ID that owns the is the group ID that owns the
@ -4690,7 +4690,7 @@ by default)
using a unique session ID that is included in the using a unique session ID that is included in the
\fBsudo\fR \fBsudo\fR
log line, prefixed with log line, prefixed with
\(Lq\fRTSID=\fR\(Rq. \(lq\fRTSID=\fR\(rq.
The The
\fIiolog_file\fR \fIiolog_file\fR
option may be used to control the format of the session ID. option may be used to control the format of the session ID.
@ -5096,7 +5096,7 @@ may run any command on machines in the
netgroup. netgroup.
\fBsudo\fR \fBsudo\fR
knows that knows that
\(Lqbiglab\(Rq \(lqbiglab\(rq
is a netgroup due to the is a netgroup due to the
\(oq+\(cq \(oq+\(cq
prefix. prefix.
@ -5234,7 +5234,7 @@ for encapsulating in a shell script.
.SH "SECURITY NOTES" .SH "SECURITY NOTES"
.SS "Limitations of the \(oq!\&\(cq operator" .SS "Limitations of the \(oq!\&\(cq operator"
It is generally not effective to It is generally not effective to
\(Lqsubtract\(Rq \(lqsubtract\(rq
commands from commands from
\fBALL\fR \fBALL\fR
using the using the
@ -5432,7 +5432,7 @@ option in
sudo(@mansectsu@). sudo(@mansectsu@).
.PP .PP
For example, to allow user operator to edit the For example, to allow user operator to edit the
\(Lqmessage of the day\(Rq \(lqmessage of the day\(rq
file: file:
.nf .nf
.sp .sp
@ -5537,7 +5537,7 @@ will log and complain.
If the If the
\fItimestamp_type\fR \fItimestamp_type\fR
option is set to option is set to
\(Lqtty\(Rq, \(lqtty\(rq,
the time stamp record includes the device number of the terminal the time stamp record includes the device number of the terminal
the user authenticated with. the user authenticated with.
This provides per-terminal granularity but time stamp records may still This provides per-terminal granularity but time stamp records may still
@ -5546,7 +5546,7 @@ outlive the user's session.
Unless the Unless the
\fItimestamp_type\fR \fItimestamp_type\fR
option is set to option is set to
\(Lqglobal\(Rq, \(lqglobal\(rq,
the time stamp record also includes the session ID of the process the time stamp record also includes the session ID of the process
that last authenticated. that last authenticated.
This prevents processes in different terminal sessions from using This prevents processes in different terminal sessions from using
@ -5557,7 +5557,7 @@ is recorded in the time stamp record.
If no terminal is present or the If no terminal is present or the
\fItimestamp_type\fR \fItimestamp_type\fR
option is set to option is set to
\(Lqppid\(Rq, \(lqppid\(rq,
the start time of the parent process is used instead. the start time of the parent process is used instead.
In most cases this will prevent a time stamp record from being re-used In most cases this will prevent a time stamp record from being re-used
without the user entering a password when logging out and back in again. without the user entering a password when logging out and back in again.
@ -5741,7 +5741,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

2
doc/sudoers_timestamp.man.in
View File

@ -302,7 +302,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudo\fR \fBsudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

14
doc/sudoreplay.man.in
View File

@ -134,7 +134,7 @@ Display a short help message to the standard output and exit.
.TP 12n .TP 12n
\fB\-l\fR, \fB\--list\fR [\fIsearch expression\fR] \fB\-l\fR, \fB\--list\fR [\fIsearch expression\fR]
Enable Enable
\(Lqlist mode\(Rq. \(lqlist mode\(rq.
In this mode, In this mode,
\fBsudoreplay\fR \fBsudoreplay\fR
will list available sessions in a format similar to the will list available sessions in a format similar to the
@ -313,13 +313,13 @@ yesterday
next Friday next Friday
The first second of the Friday in the next (upcoming) week. The first second of the Friday in the next (upcoming) week.
Not to be confused with Not to be confused with
\(Lqthis Friday\(Rq \(lqthis Friday\(rq
which would match the Friday of the current week. which would match the Friday of the current week.
.TP 8n .TP 8n
last week last week
The current time but 7 days ago. The current time but 7 days ago.
This is equivalent to This is equivalent to
\(Lqa week ago\(Rq. \(lqa week ago\(rq.
.TP 8n .TP 8n
a fortnight ago a fortnight ago
The current time but 14 days ago. The current time but 14 days ago.
@ -341,13 +341,13 @@ The current time but 14 days ago.
.PP .PP
Note that relative time specifications do not always work as expected. Note that relative time specifications do not always work as expected.
For example, the For example, the
\(Lqnext\(Rq \(lqnext\(rq
qualifier is intended to be used in conjunction with a day such as qualifier is intended to be used in conjunction with a day such as
\(Lqnext Monday\(Rq. \(lqnext Monday\(rq.
When used with units of weeks, months, years, etc When used with units of weeks, months, years, etc
the result will be one more than expected. the result will be one more than expected.
For example, For example,
\(Lqnext week\(Rq \(lqnext week\(rq
will result in a time exactly two weeks from now, which is probably will result in a time exactly two weeks from now, which is probably
not what was intended. not what was intended.
This will be addressed in a future version of This will be addressed in a future version of
@ -467,7 +467,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBsudoreplay\fR \fBsudoreplay\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.

6
doc/visudo.man.in
View File

@ -55,7 +55,7 @@ Upon finding an error,
\fBvisudo\fR \fBvisudo\fR
will print a message stating the line number(s) will print a message stating the line number(s)
where the error occurred and the user will receive the where the error occurred and the user will receive the
\(LqWhat now?\(Rq \(lqWhat now?\(rq
prompt. prompt.
At this point the user may enter At this point the user may enter
\(oqe\(cq \(oqe\(cq
@ -204,7 +204,7 @@ instead of the default,
The lock file used is the specified The lock file used is the specified
\fIsudoers\fR \fIsudoers\fR
file with file with
\(Lq\.tmp\(Rq \(lq\.tmp\(rq
appended to it. appended to it.
In In
\fIcheck-only\fR \fIcheck-only\fR
@ -459,7 +459,7 @@ search the archives.
.SH "DISCLAIMER" .SH "DISCLAIMER"
\fBvisudo\fR \fBvisudo\fR
is provided is provided
\(LqAS IS\(Rq \(lqAS IS\(rq
and any express or implied warranties, including, but not limited and any express or implied warranties, including, but not limited
to, the implied warranties of merchantability and fitness for a to, the implied warranties of merchantability and fitness for a
particular purpose are disclaimed. particular purpose are disclaimed.