mirror of
https://github.com/sudo-project/sudo.git
synced 2025-08-22 09:57:41 +00:00
Update copyright year and regen man pages.
This commit is contained in:
Todd C. Miller
parent
9de8a0bd05
commit
43ea752ded
@ -79,7 +79,7 @@ are silently ignored.
|
||||
The
|
||||
\fBsudo.conf\fR
|
||||
file is always parsed in the
|
||||
\(Lq\fRC\fR\(Rq
|
||||
\(lq\fRC\fR\(rq
|
||||
locale.
|
||||
.SS "Plugin configuration"
|
||||
\fBsudo\fR
|
||||
@ -316,7 +316,7 @@ sensitive information.
|
||||
To aid in debugging
|
||||
\fBsudo\fR
|
||||
crashes, you may wish to re-enable core dumps by setting
|
||||
\(Lqdisable_coredump\(Rq
|
||||
\(lqdisable_coredump\(rq
|
||||
to false in
|
||||
\fBsudo.conf\fR
|
||||
as follows:
|
||||
@ -386,7 +386,7 @@ Use the static group list that the kernel returns.
|
||||
Retrieving the group list this way is very fast but it is subject
|
||||
to an upper limit as described above.
|
||||
It is
|
||||
\(Lqstatic\(Rq
|
||||
\(lqstatic\(rq
|
||||
in that it does not reflect changes to the group database made
|
||||
after the user logs in.
|
||||
This was the default behavior prior to
|
||||
@ -396,7 +396,7 @@ This was the default behavior prior to
|
||||
dynamic
|
||||
Always query the group database directly.
|
||||
It is
|
||||
\(Lqdynamic\(Rq
|
||||
\(lqdynamic\(rq
|
||||
in that changes made to the group database after the user logs in
|
||||
will be reflected in the group list.
|
||||
On some systems, querying the group database for all of a user's
|
||||
@ -738,7 +738,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
|
||||
.\" IT IS GENERATED AUTOMATICALLY FROM sudo.mdoc.in
|
||||
.\"
|
||||
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2017
|
||||
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2018
|
||||
.\" Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
@ -198,7 +198,7 @@ when validating the user, if allowed by
|
||||
\fI/etc/login.conf\fR.
|
||||
The system administrator may specify a list of sudo-specific
|
||||
authentication methods by adding an
|
||||
\(Lqauth-sudo\(Rq
|
||||
\(lqauth-sudo\(rq
|
||||
entry in
|
||||
\fI/etc/login.conf\fR.
|
||||
This option is only available on systems that support BSD authentication.
|
||||
@ -728,7 +728,7 @@ can run a command.
|
||||
.PP
|
||||
If an I/O logging plugin is configured or if the security policy
|
||||
explicitly requests it, a new pseudo-terminal
|
||||
(\(Lqpty\(Rq)
|
||||
(\(lqpty\(rq)
|
||||
is allocated and
|
||||
fork(2)
|
||||
is used to create a second
|
||||
@ -749,7 +749,7 @@ exists to relay job control signals between the user's
|
||||
existing terminal and the pty the command is being run in.
|
||||
This makes it possible to suspend and resume the command.
|
||||
Without the monitor, the command would be in what POSIX terms an
|
||||
\(Lqorphaned process group\(Rq
|
||||
\(lqorphaned process group\(rq
|
||||
and it would not receive any job control signals from the kernel.
|
||||
When the command exits or is terminated by a signal, the
|
||||
\fImonitor\fR
|
||||
@ -928,7 +928,7 @@ This should not happen under normal circumstances.
|
||||
The most common reason for
|
||||
stat(2)
|
||||
to return
|
||||
\(Lqpermission denied\(Rq
|
||||
\(lqpermission denied\(rq
|
||||
is if you are running an automounter and one of the directories in
|
||||
your
|
||||
\fRPATH\fR
|
||||
@ -993,7 +993,7 @@ systems allowed setuid processes to dump core by default.
|
||||
To aid in debugging
|
||||
\fBsudo\fR
|
||||
crashes, you may wish to re-enable core dumps by setting
|
||||
\(Lqdisable_coredump\(Rq
|
||||
\(lqdisable_coredump\(rq
|
||||
to false in the
|
||||
sudo.conf(@mansectform@)
|
||||
file as follows:
|
||||
@ -1280,7 +1280,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
.\"
|
||||
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2017
|
||||
.\" Copyright (c) 1994-1996, 1998-2005, 2007-2018
|
||||
.\" Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
.\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
|
||||
.\" IT IS GENERATED AUTOMATICALLY FROM sudo_plugin.mdoc.in
|
||||
.\"
|
||||
.\" Copyright (c) 2009-2017 Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\" Copyright (c) 2009-2018 Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
@ -160,7 +160,7 @@ settings
|
||||
A vector of user-supplied
|
||||
\fBsudo\fR
|
||||
settings in the form of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
The vector is terminated by a
|
||||
\fRNULL\fR
|
||||
@ -290,9 +290,9 @@ sudo.conf(@mansectform@).
|
||||
network_addrs=list
|
||||
A space-separated list of IP network addresses and netmasks in the
|
||||
form
|
||||
\(Lqaddr/netmask\(Rq,
|
||||
\(lqaddr/netmask\(rq,
|
||||
e.g.\&
|
||||
\(Lq192.168.1.2/255.255.255.0\(Rq.
|
||||
\(lq192.168.1.2/255.255.255.0\(rq.
|
||||
The address and netmask pairs may be either IPv4 or IPv6, depending on
|
||||
what the operating system supports.
|
||||
If the address contains a colon
|
||||
@ -339,9 +339,9 @@ based on the runas user.
|
||||
.TP 6n
|
||||
progname=string
|
||||
The command name that sudo was run as, typically
|
||||
\(Lqsudo\(Rq
|
||||
\(lqsudo\(rq
|
||||
or
|
||||
\(Lqsudoedit\(Rq.
|
||||
\(lqsudoedit\(rq.
|
||||
.TP 6n
|
||||
prompt=string
|
||||
The prompt to use when requesting a password, if specified via
|
||||
@ -425,7 +425,7 @@ silently ignore settings that it does not recognize.
|
||||
.TP 6n
|
||||
user_info
|
||||
A vector of information about the user running the command in the form of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
The vector is terminated by a
|
||||
\fRNULL\fR
|
||||
@ -546,7 +546,7 @@ tty=string
|
||||
The path to the user's terminal device.
|
||||
If the user has no terminal device associated with the session,
|
||||
the value will be empty, as in
|
||||
\(Lq\fRtty=\fR\(Rq.
|
||||
\(lq\fRtty=\fR\(rq.
|
||||
.TP 6n
|
||||
uid=uid_t
|
||||
The real user ID of the user invoking
|
||||
@ -567,7 +567,7 @@ The name of the user invoking
|
||||
user_env
|
||||
The user's environment in the form of a
|
||||
\fRNULL\fR-terminated vector of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
.sp
|
||||
When parsing
|
||||
@ -720,10 +720,10 @@ into
|
||||
\fIargv_out\fR,
|
||||
separated from the
|
||||
editor and its arguments by a
|
||||
\(Lq\fR--\fR\(Rq
|
||||
\(lq\fR--\fR\(rq
|
||||
element.
|
||||
The
|
||||
\(Lq\fR--\fR\(Rq
|
||||
\(lq\fR--\fR\(rq
|
||||
will
|
||||
be removed by
|
||||
\fBsudo\fR
|
||||
@ -776,7 +776,7 @@ Additional environment variables specified by the user on the command
|
||||
line in the form of a
|
||||
\fRNULL\fR-terminated
|
||||
vector of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
The plugin may reject the command if one or more variables
|
||||
are not allowed to be set, or it may silently ignore such variables.
|
||||
@ -796,7 +796,7 @@ might.
|
||||
.TP 6n
|
||||
command_info
|
||||
Information about the command being run in the form of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
These values are used by
|
||||
\fBsudo\fR
|
||||
@ -1282,7 +1282,7 @@ argument points to the environment the command will
|
||||
run in, in the form of a
|
||||
\fRNULL\fR-terminated
|
||||
vector of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
This is the same string passed back to the front end via
|
||||
the Policy Plugin's
|
||||
@ -1620,7 +1620,7 @@ settings
|
||||
A vector of user-supplied
|
||||
\fBsudo\fR
|
||||
settings in the form of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
The vector is terminated by a
|
||||
\fRNULL\fR
|
||||
@ -1649,7 +1649,7 @@ section for a list of all possible settings.
|
||||
.TP 6n
|
||||
user_info
|
||||
A vector of information about the user running the command in the form of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
The vector is terminated by a
|
||||
\fRNULL\fR
|
||||
@ -1691,7 +1691,7 @@ user_env
|
||||
The user's environment in the form of a
|
||||
\fRNULL\fR-terminated
|
||||
vector of
|
||||
\(Lqname=value\(Rq
|
||||
\(lqname=value\(rq
|
||||
strings.
|
||||
.sp
|
||||
When parsing
|
||||
@ -2297,11 +2297,11 @@ to the policy plugin.
|
||||
A plugin may also accept a
|
||||
\fIrunas_user\fR
|
||||
in the form of
|
||||
\(Lquser@hostname\(Rq
|
||||
\(lquser@hostname\(rq
|
||||
which will work with older versions of
|
||||
\fBsudo\fR.
|
||||
It is anticipated that remote commands will be supported by executing a
|
||||
\(Lqhelper\(Rq
|
||||
\(lqhelper\(rq
|
||||
program.
|
||||
The policy plugin should setup the execution environment such that the
|
||||
\fBsudo\fR
|
||||
@ -2847,7 +2847,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
.\"
|
||||
.\" Copyright (c) 2009-2017 Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\" Copyright (c) 2009-2018 Todd C. Miller <Todd.Miller@sudo.ws>
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
|
||||
@ -161,7 +161,7 @@ If a command name is preceded by an exclamation point,
|
||||
the user will be prohibited from running that command.
|
||||
.sp
|
||||
The built-in command
|
||||
\(Lq\fRsudoedit\fR\(Rq
|
||||
\(lq\fRsudoedit\fR\(rq
|
||||
is used to permit a user to run
|
||||
\fBsudo\fR
|
||||
with the
|
||||
@ -170,7 +170,7 @@ option (or as
|
||||
\fBsudoedit\fR).
|
||||
It may take command line arguments just as a normal command does.
|
||||
Note that
|
||||
\(Lq\fRsudoedit\fR\(Rq
|
||||
\(lq\fRsudoedit\fR\(rq
|
||||
is a command built into
|
||||
\fBsudo\fR
|
||||
itself and must be specified in without a leading path.
|
||||
@ -321,7 +321,7 @@ If multiple entries match, the entry with the highest
|
||||
\fRsudoOrder\fR
|
||||
attribute is chosen.
|
||||
This corresponds to the
|
||||
\(Lqlast match\(Rq
|
||||
\(lqlast match\(rq
|
||||
behavior of the sudoers file.
|
||||
If the
|
||||
\fRsudoOrder\fR
|
||||
@ -625,7 +625,7 @@ sudoOption: !authenticate
|
||||
.fi
|
||||
.PP
|
||||
This assumes that users john and sally are members of the
|
||||
\(Lqadmins\(Rq
|
||||
\(lqadmins\(rq
|
||||
Unix group.
|
||||
.SS "Sudoers schema"
|
||||
In order to use
|
||||
@ -725,7 +725,7 @@ parameter.
|
||||
The
|
||||
\fIsecret\fR
|
||||
may be a plain text password or a base64-encoded string with a
|
||||
\(Lqbase64:\(Rq
|
||||
\(lqbase64:\(rq
|
||||
prefix.
|
||||
For example:
|
||||
.nf
|
||||
@ -954,7 +954,7 @@ parameter is deprecated and will be removed in a future release.
|
||||
The same information is now logged via the
|
||||
\fBsudo\fR
|
||||
debugging framework using the
|
||||
\(Lqldap\(Rq
|
||||
\(lqldap\(rq
|
||||
subsystem at priorities
|
||||
\fIdiag\fR
|
||||
and
|
||||
@ -1116,7 +1116,7 @@ using the Tivoli Directory Server LDAP library.
|
||||
The
|
||||
\fIsecret\fR
|
||||
may be a plain text password or a base64-encoded string with a
|
||||
\(Lqbase64:\(Rq
|
||||
\(lqbase64:\(rq
|
||||
prefix.
|
||||
For example:
|
||||
.nf
|
||||
@ -1633,7 +1633,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -386,7 +386,7 @@ env_keep += "BASH_FUNC_my_func%%=()*"
|
||||
.fi
|
||||
.PP
|
||||
Without the
|
||||
\(Lq\fR=()*\fR\(Rq
|
||||
\(lq\fR=()*\fR\(rq
|
||||
suffix, this would not match, as
|
||||
\fBbash\fR
|
||||
shell functions are not preserved by default.
|
||||
@ -394,7 +394,7 @@ shell functions are not preserved by default.
|
||||
The complete list of environment variables that
|
||||
\fBsudo\fR
|
||||
allows or denies is contained in the output of
|
||||
\(Lq\fRsudo -V\fR\(Rq
|
||||
\(lq\fRsudo -V\fR\(rq
|
||||
when run as root.
|
||||
Please note that this list varies based on the operating system
|
||||
\fBsudo\fR
|
||||
@ -535,7 +535,7 @@ EBNF also contains the following
|
||||
operators, which many readers will recognize from regular
|
||||
expressions.
|
||||
Do not, however, confuse them with
|
||||
\(Lqwildcard\(Rq
|
||||
\(lqwildcard\(rq
|
||||
characters, which have different meanings.
|
||||
.TP 6n
|
||||
\fR\&?\fR
|
||||
@ -799,7 +799,7 @@ Note that
|
||||
only inspects actual network interfaces; this means that IP address
|
||||
127.0.0.1 (localhost) will never match.
|
||||
Also, the host name
|
||||
\(Lqlocalhost\(Rq
|
||||
\(lqlocalhost\(rq
|
||||
will only match if that is the actual host name, which is usually
|
||||
only the case for non-networked systems.
|
||||
.nf
|
||||
@ -867,7 +867,7 @@ if they are used in command arguments:
|
||||
\(oq=\&\(cq,
|
||||
\(oq\e\(cq.
|
||||
The built-in command
|
||||
\(Lq\fRsudoedit\fR\(Rq
|
||||
\(lq\fRsudoedit\fR\(rq
|
||||
is used to permit a user to run
|
||||
\fBsudo\fR
|
||||
with the
|
||||
@ -876,7 +876,7 @@ option (or as
|
||||
\fBsudoedit\fR).
|
||||
It may take command line arguments just as a normal command does.
|
||||
Note that
|
||||
\(Lq\fRsudoedit\fR\(Rq
|
||||
\(lq\fRsudoedit\fR\(rq
|
||||
is a command built into
|
||||
\fBsudo\fR
|
||||
itself and must be specified in the
|
||||
@ -1044,7 +1044,7 @@ run as
|
||||
but this can be changed on a per-command basis.
|
||||
.PP
|
||||
The basic structure of a user specification is
|
||||
\(Lqwho where = (as_whom) what\(Rq.
|
||||
\(lqwho where = (as_whom) what\(rq.
|
||||
Let's break that down into its constituent parts:
|
||||
.SS "Runas_Spec"
|
||||
A
|
||||
@ -1271,7 +1271,7 @@ $ ppriv -l
|
||||
.fi
|
||||
.PP
|
||||
In addition, there are several
|
||||
\(Lqspecial\(Rq
|
||||
\(lqspecial\(rq
|
||||
privilege strings:
|
||||
.TP 10n
|
||||
none
|
||||
@ -1556,10 +1556,10 @@ By default, if the
|
||||
\fRNOPASSWD\fR
|
||||
tag is applied to any of the entries for a user on the current host,
|
||||
he or she will be able to run
|
||||
\(Lq\fRsudo -l\fR\(Rq
|
||||
\(lq\fRsudo -l\fR\(rq
|
||||
without a password.
|
||||
Additionally, a user may only run
|
||||
\(Lq\fRsudo -v\fR\(Rq
|
||||
\(lq\fRsudo -v\fR\(rq
|
||||
without a password if the
|
||||
\fRNOPASSWD\fR
|
||||
tag is present for all a user's entries that pertain to the current host.
|
||||
@ -1609,7 +1609,7 @@ glob(3)
|
||||
and
|
||||
fnmatch(3)
|
||||
functions as specified by
|
||||
IEEE Std 1003.1 (\(LqPOSIX.1\(Rq).
|
||||
IEEE Std 1003.1 (\(lqPOSIX.1\(rq).
|
||||
.TP 10n
|
||||
\fR*\fR
|
||||
Matches any set of zero or more characters (including white space).
|
||||
@ -1812,7 +1812,7 @@ The file name may also include the
|
||||
\fR%h\fR
|
||||
escape, signifying the short form of the host name.
|
||||
In other words, if the machine's host name is
|
||||
\(Lqxerxes\(Rq,
|
||||
\(lqxerxes\(rq,
|
||||
then
|
||||
.nf
|
||||
.sp
|
||||
@ -1945,7 +1945,7 @@ is omitted, as in:
|
||||
.PP
|
||||
it would explicitly deny root but not match any other users.
|
||||
This is different from a true
|
||||
\(Lqnegation\(Rq
|
||||
\(lqnegation\(rq
|
||||
operator.
|
||||
.PP
|
||||
Note, however, that using a
|
||||
@ -1953,7 +1953,7 @@ Note, however, that using a
|
||||
in conjunction with the built-in
|
||||
\fBALL\fR
|
||||
alias to allow a user to run
|
||||
\(Lqall but a few\(Rq
|
||||
\(lqall but a few\(rq
|
||||
commands rarely works as intended (see
|
||||
\fISECURITY NOTES\fR
|
||||
below).
|
||||
@ -2279,7 +2279,7 @@ command) does not contain the domain name.
|
||||
In other words, instead of myhost you would use myhost.mydomain.edu.
|
||||
You may still use the short form if you wish (and even mix the two).
|
||||
This option is only effective when the
|
||||
\(Lqcanonical\(Rq
|
||||
\(lqcanonical\(rq
|
||||
host name, as returned by the
|
||||
\fBgetaddrinfo\fR()
|
||||
or
|
||||
@ -2291,7 +2291,7 @@ for host name resolution.
|
||||
If the system is configured to use the
|
||||
\fI/etc/hosts\fR
|
||||
file in preference to DNS, the
|
||||
\(Lqcanonical\(Rq
|
||||
\(lqcanonical\(rq
|
||||
host name may not be fully-qualified.
|
||||
The order that sources are queried for host name resolution
|
||||
is usually specified in the
|
||||
@ -2304,13 +2304,13 @@ file.
|
||||
In the
|
||||
\fI/etc/hosts\fR
|
||||
file, the first host name of the entry is considered to be the
|
||||
\(Lqcanonical\(Rq
|
||||
\(lqcanonical\(rq
|
||||
name; subsequent names are aliases that are not used by
|
||||
\fBsudoers\fR.
|
||||
For example, the following hosts file line for the machine
|
||||
\(Lqxyzzy\(Rq
|
||||
\(lqxyzzy\(rq
|
||||
has the fully-qualified domain name as the
|
||||
\(Lqcanonical\(Rq
|
||||
\(lqcanonical\(rq
|
||||
host name, and the short version as an alias.
|
||||
.sp
|
||||
.RS 24n
|
||||
@ -2331,7 +2331,7 @@ to make DNS lookups which renders
|
||||
unusable if DNS stops working (for example if the machine is disconnected
|
||||
from the network).
|
||||
Also note that just like with the hosts file, you must use the
|
||||
\(Lqcanonical\(Rq
|
||||
\(lqcanonical\(rq
|
||||
name as DNS knows it.
|
||||
That is, you may not use a host alias
|
||||
(\fRCNAME\fR
|
||||
@ -2791,10 +2791,10 @@ If set, root is allowed to run
|
||||
\fBsudo\fR
|
||||
too.
|
||||
Disabling this prevents users from
|
||||
\(Lqchaining\(Rq
|
||||
\(lqchaining\(rq
|
||||
\fBsudo\fR
|
||||
commands to get a root shell by doing something like
|
||||
\(Lq\fRsudo sudo /bin/sh\fR\(Rq.
|
||||
\(lq\fRsudo sudo /bin/sh\fR\(rq.
|
||||
Note, however, that turning off
|
||||
\fIroot_sudo\fR
|
||||
will also prevent root from running
|
||||
@ -3159,7 +3159,7 @@ flag is set,
|
||||
\fBsudo\fR
|
||||
will prompt for a password even when it would be visible on the screen.
|
||||
This makes it possible to run things like
|
||||
\(Lq\fRssh somehost sudo ls\fR\(Rq
|
||||
\(lq\fRssh somehost sudo ls\fR\(rq
|
||||
since by default,
|
||||
ssh(1)
|
||||
does
|
||||
@ -3193,25 +3193,25 @@ This setting is only supported by version 1.8.20 or higher.
|
||||
.TP 18n
|
||||
maxseq
|
||||
The maximum sequence number that will be substituted for the
|
||||
\(Lq\fR%{seq}\fR\(Rq
|
||||
\(lq\fR%{seq}\fR\(rq
|
||||
escape in the I/O log file (see the
|
||||
\fIiolog_dir\fR
|
||||
description above for more information).
|
||||
While the value substituted for
|
||||
\(Lq\fR%{seq}\fR\(Rq
|
||||
\(lq\fR%{seq}\fR\(rq
|
||||
is in base 36,
|
||||
\fImaxseq\fR
|
||||
itself should be expressed in decimal.
|
||||
Values larger than 2176782336 (which corresponds to the
|
||||
base 36 sequence number
|
||||
\(LqZZZZZZ\(Rq)
|
||||
\(lqZZZZZZ\(rq)
|
||||
will be silently truncated to 2176782336.
|
||||
The default value is 2176782336.
|
||||
.sp
|
||||
Once the local sequence number reaches the value of
|
||||
\fImaxseq\fR,
|
||||
it will
|
||||
\(Lqroll over\(Rq
|
||||
\(lqroll over\(rq
|
||||
to zero, after which
|
||||
\fBsudoers\fR
|
||||
will truncate and re-use any existing I/O log path names.
|
||||
@ -3242,7 +3242,7 @@ will split up log messages that are larger than
|
||||
\fIsyslog_maxlen\fR
|
||||
bytes.
|
||||
When a message is split, additional parts will include the string
|
||||
\(Lq(command continued)\(Rq
|
||||
\(lq(command continued)\(rq
|
||||
after the user name and before the continued command line arguments.
|
||||
.sp
|
||||
This setting is only supported by version 1.8.19 or higher.
|
||||
@ -3287,9 +3287,9 @@ If set to a value less than
|
||||
\fR0\fR
|
||||
the user's time stamp will not expire until the system is rebooted.
|
||||
This can be used to allow users to create or delete their own time stamps via
|
||||
\(Lq\fRsudo -v\fR\(Rq
|
||||
\(lq\fRsudo -v\fR\(rq
|
||||
and
|
||||
\(Lq\fRsudo -k\fR\(Rq
|
||||
\(lq\fRsudo -k\fR\(rq
|
||||
respectively.
|
||||
.TP 18n
|
||||
umask
|
||||
@ -3424,7 +3424,7 @@ Note that
|
||||
\fIiolog_file\fR
|
||||
may contain directory components.
|
||||
The default is
|
||||
\(Lq\fR%{seq}\fR\(Rq.
|
||||
\(lq\fR%{seq}\fR\(rq.
|
||||
.sp
|
||||
See the
|
||||
\fIiolog_dir\fR
|
||||
@ -3545,7 +3545,7 @@ The escape
|
||||
\fR%h\fR
|
||||
will expand to the host name of the machine.
|
||||
Default is
|
||||
\(Lq\fR@mailsub@\fR\(Rq.
|
||||
\(lq\fR@mailsub@\fR\(rq.
|
||||
.TP 18n
|
||||
noexec_file
|
||||
As of
|
||||
@ -3562,7 +3562,7 @@ name used when the
|
||||
\fB\-i\fR
|
||||
option is specified.
|
||||
The default value is
|
||||
\(Lq\fR@pam_login_service@\fR\(Rq.
|
||||
\(lq\fR@pam_login_service@\fR\(rq.
|
||||
See the description of
|
||||
\fIpam_service\fR
|
||||
for more information.
|
||||
@ -3578,7 +3578,7 @@ file or a file in the
|
||||
\fI/etc/pam.d\fR
|
||||
directory.
|
||||
The default value is
|
||||
\(Lq\fRsudo\fR\(Rq.
|
||||
\(lq\fRsudo\fR\(rq.
|
||||
.sp
|
||||
This setting is only supported by version 1.8.8 or higher.
|
||||
.TP 18n
|
||||
@ -3631,9 +3631,9 @@ character
|
||||
On systems that use PAM for authentication,
|
||||
\fIpassprompt\fR
|
||||
will only be used if the prompt provided by the PAM module matches the string
|
||||
\(LqPassword: \(Rq
|
||||
\(lqPassword: \(rq
|
||||
or
|
||||
\(Lqusername's Password: \(Rq.
|
||||
\(lqusername's Password: \(rq.
|
||||
This ensures that the
|
||||
\fIpassprompt\fR
|
||||
setting does not interfere with challenge-response style authentication.
|
||||
@ -3642,7 +3642,7 @@ The
|
||||
flag can be used to change this behavior.
|
||||
.sp
|
||||
The default value is
|
||||
\(Lq\fR@passprompt@\fR\(Rq.
|
||||
\(lq\fR@passprompt@\fR\(rq.
|
||||
.RE
|
||||
.TP 18n
|
||||
privs
|
||||
@ -3684,7 +3684,7 @@ Locale to use when parsing the sudoers file, logging commands, and
|
||||
sending email.
|
||||
Note that changing the locale may affect how sudoers is interpreted.
|
||||
Defaults to
|
||||
\(Lq\fRC\fR\(Rq.
|
||||
\(lq\fRC\fR\(rq.
|
||||
.TP 18n
|
||||
timestamp_type
|
||||
\fBsudoers\fR
|
||||
@ -3781,9 +3781,9 @@ The
|
||||
option specifies the fully qualified path to a file containing variables
|
||||
to be set in the environment of the program being run.
|
||||
Entries in this file should either be of the form
|
||||
\(Lq\fRVARIABLE=value\fR\(Rq
|
||||
\(lq\fRVARIABLE=value\fR\(rq
|
||||
or
|
||||
\(Lq\fRexport VARIABLE=value\fR\(Rq.
|
||||
\(lq\fRexport VARIABLE=value\fR\(rq.
|
||||
The value may optionally be surrounded by single or double quotes.
|
||||
Variables in this file are only added if the variable does not already
|
||||
exist in the environment.
|
||||
@ -3977,7 +3977,7 @@ Defaults to the path to sendmail found at configure time.
|
||||
.TP 14n
|
||||
mailfrom
|
||||
Address to use for the
|
||||
\(Lqfrom\(Rq
|
||||
\(lqfrom\(rq
|
||||
address when sending warning and error mail.
|
||||
The address should be enclosed in double quotes
|
||||
(\&"")
|
||||
@ -4007,9 +4007,9 @@ The
|
||||
option specifies the fully qualified path to a file containing variables
|
||||
to be set in the environment of the program being run.
|
||||
Entries in this file should either be of the form
|
||||
\(Lq\fRVARIABLE=value\fR\(Rq
|
||||
\(lq\fRVARIABLE=value\fR\(rq
|
||||
or
|
||||
\(Lq\fRexport VARIABLE=value\fR\(Rq.
|
||||
\(lq\fRexport VARIABLE=value\fR\(rq.
|
||||
The value may optionally be surrounded by single or double quotes.
|
||||
Variables in this file are only added if the variable does not already
|
||||
exist in the environment.
|
||||
@ -4046,9 +4046,9 @@ to have a sane
|
||||
\fRPATH\fR
|
||||
environment variable you may want to use this.
|
||||
Another use is if you want to have the
|
||||
\(Lqroot path\(Rq
|
||||
\(lqroot path\(rq
|
||||
be separate from the
|
||||
\(Lquser path\(Rq.
|
||||
\(lquser path\(rq.
|
||||
Users in the group specified by the
|
||||
\fIexempt_group\fR
|
||||
option are not affected by
|
||||
@ -4164,10 +4164,10 @@ The default value is
|
||||
env_check
|
||||
Environment variables to be removed from the user's environment
|
||||
unless they are considered
|
||||
\(Lqsafe\(Rq.
|
||||
\(lqsafe\(rq.
|
||||
For all variables except
|
||||
\fRTZ\fR,
|
||||
\(Lqsafe\(Rq
|
||||
\(lqsafe\(rq
|
||||
means that the variable's value does not contain any
|
||||
\(oq%\(cq
|
||||
or
|
||||
@ -4354,7 +4354,7 @@ Where the fields are as follows:
|
||||
date
|
||||
The date the command was run.
|
||||
Typically, this is in the format
|
||||
\(LqMMM, DD, HH:MM:SS\(Rq.
|
||||
\(lqMMM, DD, HH:MM:SS\(rq.
|
||||
If logging via
|
||||
syslog(3),
|
||||
the actual date format is controlled by the syslog daemon.
|
||||
@ -4384,13 +4384,13 @@ The login name of the user who ran
|
||||
.TP 14n
|
||||
ttyname
|
||||
The short name of the terminal (e.g.\&
|
||||
\(Lqconsole\(Rq,
|
||||
\(Lqtty01\(Rq,
|
||||
\(lqconsole\(rq,
|
||||
\(lqtty01\(rq,
|
||||
or
|
||||
\(Lqpts/0\(Rq)
|
||||
\(lqpts/0\(rq)
|
||||
\fBsudo\fR
|
||||
was run on, or
|
||||
\(Lqunknown\(Rq
|
||||
\(lqunknown\(rq
|
||||
if there was no terminal present.
|
||||
.TP 14n
|
||||
cwd
|
||||
@ -4422,7 +4422,7 @@ The actual command that was executed.
|
||||
Messages are logged using the locale specified by
|
||||
\fIsudoers_locale\fR,
|
||||
which defaults to the
|
||||
\(Lq\fRC\fR\(Rq
|
||||
\(lq\fRC\fR\(rq
|
||||
locale.
|
||||
.SS "Denied command log entries"
|
||||
If the user is not allowed to run the command, the reason for the denial
|
||||
@ -4505,7 +4505,7 @@ file using group permissions to avoid this problem.
|
||||
Consider either changing the ownership of
|
||||
\fI@sysconfdir@/sudoers\fR
|
||||
or adding an argument like
|
||||
\(Lqsudoers_uid=N\(Rq
|
||||
\(lqsudoers_uid=N\(rq
|
||||
(where
|
||||
\(oqN\(cq
|
||||
is the user ID that owns the
|
||||
@ -4534,7 +4534,7 @@ file has the wrong owner.
|
||||
If you wish to change the
|
||||
\fIsudoers\fR
|
||||
file owner, please add
|
||||
\(Lqsudoers_uid=N\(Rq
|
||||
\(lqsudoers_uid=N\(rq
|
||||
(where
|
||||
\(oqN\(cq
|
||||
is the user ID that owns the
|
||||
@ -4555,7 +4555,7 @@ The
|
||||
file must not be world-writable, the default file mode
|
||||
is 0440 (readable by owner and group, writable by none).
|
||||
The default mode may be changed via the
|
||||
\(Lqsudoers_mode\(Rq
|
||||
\(lqsudoers_mode\(rq
|
||||
option to the
|
||||
\fBsudoers\fR
|
||||
\fRPlugin\fR
|
||||
@ -4570,7 +4570,7 @@ file has the wrong group ownership.
|
||||
If you wish to change the
|
||||
\fIsudoers\fR
|
||||
file group ownership, please add
|
||||
\(Lqsudoers_gid=N\(Rq
|
||||
\(lqsudoers_gid=N\(rq
|
||||
(where
|
||||
\(oqN\(cq
|
||||
is the group ID that owns the
|
||||
@ -4690,7 +4690,7 @@ by default)
|
||||
using a unique session ID that is included in the
|
||||
\fBsudo\fR
|
||||
log line, prefixed with
|
||||
\(Lq\fRTSID=\fR\(Rq.
|
||||
\(lq\fRTSID=\fR\(rq.
|
||||
The
|
||||
\fIiolog_file\fR
|
||||
option may be used to control the format of the session ID.
|
||||
@ -5096,7 +5096,7 @@ may run any command on machines in the
|
||||
netgroup.
|
||||
\fBsudo\fR
|
||||
knows that
|
||||
\(Lqbiglab\(Rq
|
||||
\(lqbiglab\(rq
|
||||
is a netgroup due to the
|
||||
\(oq+\(cq
|
||||
prefix.
|
||||
@ -5234,7 +5234,7 @@ for encapsulating in a shell script.
|
||||
.SH "SECURITY NOTES"
|
||||
.SS "Limitations of the \(oq!\&\(cq operator"
|
||||
It is generally not effective to
|
||||
\(Lqsubtract\(Rq
|
||||
\(lqsubtract\(rq
|
||||
commands from
|
||||
\fBALL\fR
|
||||
using the
|
||||
@ -5432,7 +5432,7 @@ option in
|
||||
sudo(@mansectsu@).
|
||||
.PP
|
||||
For example, to allow user operator to edit the
|
||||
\(Lqmessage of the day\(Rq
|
||||
\(lqmessage of the day\(rq
|
||||
file:
|
||||
.nf
|
||||
.sp
|
||||
@ -5537,7 +5537,7 @@ will log and complain.
|
||||
If the
|
||||
\fItimestamp_type\fR
|
||||
option is set to
|
||||
\(Lqtty\(Rq,
|
||||
\(lqtty\(rq,
|
||||
the time stamp record includes the device number of the terminal
|
||||
the user authenticated with.
|
||||
This provides per-terminal granularity but time stamp records may still
|
||||
@ -5546,7 +5546,7 @@ outlive the user's session.
|
||||
Unless the
|
||||
\fItimestamp_type\fR
|
||||
option is set to
|
||||
\(Lqglobal\(Rq,
|
||||
\(lqglobal\(rq,
|
||||
the time stamp record also includes the session ID of the process
|
||||
that last authenticated.
|
||||
This prevents processes in different terminal sessions from using
|
||||
@ -5557,7 +5557,7 @@ is recorded in the time stamp record.
|
||||
If no terminal is present or the
|
||||
\fItimestamp_type\fR
|
||||
option is set to
|
||||
\(Lqppid\(Rq,
|
||||
\(lqppid\(rq,
|
||||
the start time of the parent process is used instead.
|
||||
In most cases this will prevent a time stamp record from being re-used
|
||||
without the user entering a password when logging out and back in again.
|
||||
@ -5741,7 +5741,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -302,7 +302,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -134,7 +134,7 @@ Display a short help message to the standard output and exit.
|
||||
.TP 12n
|
||||
\fB\-l\fR, \fB\--list\fR [\fIsearch expression\fR]
|
||||
Enable
|
||||
\(Lqlist mode\(Rq.
|
||||
\(lqlist mode\(rq.
|
||||
In this mode,
|
||||
\fBsudoreplay\fR
|
||||
will list available sessions in a format similar to the
|
||||
@ -313,13 +313,13 @@ yesterday
|
||||
next Friday
|
||||
The first second of the Friday in the next (upcoming) week.
|
||||
Not to be confused with
|
||||
\(Lqthis Friday\(Rq
|
||||
\(lqthis Friday\(rq
|
||||
which would match the Friday of the current week.
|
||||
.TP 8n
|
||||
last week
|
||||
The current time but 7 days ago.
|
||||
This is equivalent to
|
||||
\(Lqa week ago\(Rq.
|
||||
\(lqa week ago\(rq.
|
||||
.TP 8n
|
||||
a fortnight ago
|
||||
The current time but 14 days ago.
|
||||
@ -341,13 +341,13 @@ The current time but 14 days ago.
|
||||
.PP
|
||||
Note that relative time specifications do not always work as expected.
|
||||
For example, the
|
||||
\(Lqnext\(Rq
|
||||
\(lqnext\(rq
|
||||
qualifier is intended to be used in conjunction with a day such as
|
||||
\(Lqnext Monday\(Rq.
|
||||
\(lqnext Monday\(rq.
|
||||
When used with units of weeks, months, years, etc
|
||||
the result will be one more than expected.
|
||||
For example,
|
||||
\(Lqnext week\(Rq
|
||||
\(lqnext week\(rq
|
||||
will result in a time exactly two weeks from now, which is probably
|
||||
not what was intended.
|
||||
This will be addressed in a future version of
|
||||
@ -467,7 +467,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBsudoreplay\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
@ -55,7 +55,7 @@ Upon finding an error,
|
||||
\fBvisudo\fR
|
||||
will print a message stating the line number(s)
|
||||
where the error occurred and the user will receive the
|
||||
\(LqWhat now?\(Rq
|
||||
\(lqWhat now?\(rq
|
||||
prompt.
|
||||
At this point the user may enter
|
||||
\(oqe\(cq
|
||||
@ -204,7 +204,7 @@ instead of the default,
|
||||
The lock file used is the specified
|
||||
\fIsudoers\fR
|
||||
file with
|
||||
\(Lq\.tmp\(Rq
|
||||
\(lq\.tmp\(rq
|
||||
appended to it.
|
||||
In
|
||||
\fIcheck-only\fR
|
||||
@ -459,7 +459,7 @@ search the archives.
|
||||
.SH "DISCLAIMER"
|
||||
\fBvisudo\fR
|
||||
is provided
|
||||
\(LqAS IS\(Rq
|
||||
\(lqAS IS\(rq
|
||||
and any express or implied warranties, including, but not limited
|
||||
to, the implied warranties of merchantability and fitness for a
|
||||
particular purpose are disclaimed.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user