path: root/sudo.cat

SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)


NNNNAAAAMMMMEEEE
       sudo - execute a command as another user

SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS
       ssssuuuuddddoooo ----VVVV | ----hhhh | ----llll | ----vvvv | ----kkkk | ----KKKK | ----ssss | ----HHHH | [ ----bbbb ] | [ ----rrrr
       realm ] | [ ----pppp prompt ] [ ----uuuu username/#uid] _c_o_m_m_a_n_d

DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
       ssssuuuuddddoooo allows a permitted user to execute a _c_o_m_m_a_n_d as the
       superuser or another user, as specified in the sudoers
       file.  The real and effective uid and gid are set to match
       those of the target user as specified in the passwd file
       (the group vector is also initialized when the target user
       is not root).

       ssssuuuuddddoooo determines who is an authorized user by consulting
       the file _/_e_t_c_/_s_u_d_o_e_r_s.  By giving ssssuuuuddddoooo the -v flag a user
       can update the time stamp without running a _c_o_m_m_a_n_d_.  The
       password prompt itself will also time out if the user's
       password is not entered with N minutes (again, this is
       defined at configure time and defaults to 5 minutes).

       If a user that is not listed in the _s_u_d_o_e_r_s file tries to
       run a command via ssssuuuuddddoooo, mail is sent to the proper
       authorities, as defined at configure time (defaults to
       root).  Note that the mail will not be sent if an
       unauthorized user tries to run sudo with the -l or -v
       flags.  This allows users to determine for themselves
       whether or not they are allowed to use ssssuuuuddddoooo.

       ssssuuuuddddoooo can log both successful an unsuccessful attempts (as
       well as errors) to _s_y_s_l_o_g(3), a log file, or both.  By
       default ssssuuuuddddoooo will log via _s_y_s_l_o_g(3) but this is changeable
       at configure time.

OOOOPPPPTTTTIIIIOOOONNNNSSSS
       ssssuuuuddddoooo accepts the following command line options:

       -V  The -V (_v_e_r_s_i_o_n) option causes ssssuuuuddddoooo to print the
           version number and exit.

       -l  The -l (_l_i_s_t) option will list out the allowed and
           forbidden commands for the user on the current host.

       -h  The -h (_h_e_l_p) option causes ssssuuuuddddoooo to print the version
           of ssssuuuuddddoooo and a usage message before exiting.

       -v  If given the -v (_v_a_l_i_d_a_t_e) option, ssssuuuuddddoooo will update
           the user's timestamp, prompting for the user's
           password if necessary.  This extends the ssssuuuuddddoooo timeout
           to for another N minutes (where N is defined at
           installation time and defaults to 5 minutes) but does
           not run a command.




17/Aug/1999                    1.6                              1





SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)


       -k  The -k (_k_i_l_l) option to ssssuuuuddddoooo invalidates the user's
           timestamp file by setting the time on it to the epoch.
           The next time ssssuuuuddddoooo is run a password will be required.
           This option does not require a password and was added
           to allow a user to revoke ssssuuuuddddoooo permissions from a
           .logout file.

       -K  The -K (sure _k_i_l_l) option to ssssuuuuddddoooo removes the user's
           timestamp file entirely.  This option does not require
           a password.

       -b  The -b (_b_a_c_k_g_r_o_u_n_d) option tells ssssuuuuddddoooo to run the given
           command in the background.  Note that if you use the
           -b option you cannot use shell job control to
           manipulate the command.

       -r  The -r (_r_e_a_l_m) option is only available if ssssuuuuddddoooo was
           configured with KKKKeeeerrrrbbbbeeeerrrroooossss version 5 support.  It allows
           the user to specify a KKKKeeeerrrrbbbbeeeerrrroooossss realm other than the
           system default to use when authenticating the user via
           KKKKeeeerrrrbbbbeeeerrrroooossss.

       -p  The -p (_p_r_o_m_p_t) option allows you to override the
           default password prompt and use a custom one.  If the
           password prompt contains the %u escape, %u will be
           replaced with the user's login name.  Similarly, %h
           will be replaced with the local hostname.

       -u  The -u (_u_s_e_r) option causes sudo to run the specified
           command as a user other than _r_o_o_t.  To specify a _u_i_d
           instead of a _u_s_e_r_n_a_m_e, use "#uid".

       -s  The -s (_s_h_e_l_l) option runs the shell specified by the
           _S_H_E_L_L environment variable if it is set or the shell
           as specified in _p_a_s_s_w_d(5).

       -H  The -H (_H_O_M_E) option sets the _H_O_M_E environment
           variable to the homedir of the target user (root by
           default) as specified in _p_a_s_s_w_d(5).  By default, ssssuuuuddddoooo
           does not modify _H_O_M_E.

       --  The -- flag indicates that ssssuuuuddddoooo should stop processing
           command line arguments.  It is most useful in
           conjunction with the -s flag.

RRRREEEETTTTUUUURRRRNNNN VVVVAAAALLLLUUUUEEEESSSS
       ssssuuuuddddoooo quits with an exit value of 1 if there is a
       configuration/permission problem or if ssssuuuuddddoooo cannot execute
       the given command.  In the latter case the error string is
       printed to stderr.  If ssssuuuuddddoooo cannot _s_t_a_t(2) one or more
       entries in the user's PATH an error is printed on stderr.
       (If the directory does not exist or if it is not really a
       directory, the entry is ignored and no error is printed.)
       This should not happen under normal circumstances.  The



17/Aug/1999                    1.6                              2





SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)


       most common reason for _s_t_a_t(2) to return "permission
       denied" is if you are running an automounter and one of
       the directories in your PATH is on a machine that is
       currently unreachable.

SSSSEEEECCCCUUUURRRRIIIITTTTYYYY NNNNOOOOTTTTEEEESSSS
       ssssuuuuddddoooo tries to be safe when executing external commands.
       Variables that control how dynamic loading and binding is
       done can be used to subvert the program that ssssuuuuddddoooo runs.
       To combat this the LD_*, _RLD_*, SHLIB_PATH (HP-UX only),
       and LIBPATH (AIX only) environment variables are removed
       from the environment passed on to all commands executed.
       ssssuuuuddddoooo will also remove the IFS, ENV, BASH_ENV, KRB_CONF,
       KRB5_CONFIG, LOCALDOMAIN, RES_OPTIONS and HOSTALIASES
       variables as they too can pose a threat.

       To prevent command spoofing, ssssuuuuddddoooo checks "." and "" (both
       denoting current directory) last when searching for a
       command in the user's PATH (if one or both are in the
       PATH).  Note, however, that the actual PATH environment
       variable is _n_o_t modified and is passed unchanged to the
       program that ssssuuuuddddoooo executes.

       For security reasons, if your OS supports shared libraries
       and does not disable user-defined library search paths for
       setuid programs (most do), you should either use a linker
       option that disables this behavior or link ssssuuuuddddoooo
       statically.

       ssssuuuuddddoooo will check the ownership of its timestamp directory
       (_/_v_a_r_/_r_u_n_/_s_u_d_o or _/_t_m_p_/_._o_d_u_s by default) and ignore the
       directory's contents if it is not owned by root and only
       writable by root.  On systems that allow non-root users to
       give away files via _c_h_o_w_n(2), if the timestamp directory
       is located in a directory writable by anyone (ie: _/_t_m_p),
       it is possible for a user to create the timestamp
       directory before ssssuuuuddddoooo is run.  However, because ssssuuuuddddoooo
       checks the ownership and mode of the directory and its
       contents, the only damage that can be done is to "hide"
       files by putting them in the timestamp dir.  This is
       unlikely to happen since once the timestamp dir is owned
       by root and inaccessible by any other user the user
       placing files there would be unable to get them back out.
       To get around this issue you can use a directory that is
       not world-writable for the timestamps (_/_v_a_r_/_a_d_m_/_s_u_d_o for
       instance) or create /tmp/.odus with the appropriate owner
       (root) and permissions (0700) in the system startup files.

       sudo will not honor timestamps set far in the future.
       Timestamps with a date greater than current_time + 2 *
       TIMEOUT will be ignored and sudo will log and complain.
       This is done to keep a user from creating his/her own
       timestamp with a bogus date on system that allow users to
       give away files.



17/Aug/1999                    1.6                              3





SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)


FFFFIIIILLLLEEEESSSS
        /etc/sudoers           List of who can run what
        /var/run/sudo          Directory containing timestamps
        /tmp/.odus             Same as above if no /var/run exists


EEEENNNNVVVVIIIIRRRROOOONNNNMMMMEEEENNNNTTTT VVVVAAAARRRRIIIIAAAABBBBLLLLEEEESSSS
        PATH                   Set to a sane value if SECURE_PATH is set
        SHELL                  Used to determine shell to run with -s option
        USER                   Set to the target user (root unless the -u option
                               is specified)
        HOME                   In -s or -H mode (or if sudo was configured with
                               the --enable-shell-sets-home option), set to
                               homedir of the target user.
        SUDO_PROMPT            Used as the default password prompt
        SUDO_COMMAND           Set to the command run by sudo
        SUDO_USER              Set to the login of the user who invoked sudo
        SUDO_UID               Set to the uid of the user who invoked sudo
        SUDO_GID               Set to the gid of the user who invoked sudo
        SUDO_PS1               If set, PS1 will be set to its value


AAAAUUUUTTTTHHHHOOOORRRRSSSS
       Many people have worked on ssssuuuuddddoooo over the years, this
       version consists of code written primarily by:

               Todd Miller
               Chris Jepeway

       See the HISTORY file in the ssssuuuuddddoooo distribution for a short
       history of ssssuuuuddddoooo.

BBBBUUUUGGGGSSSS
       Please send all bugs, comments, and changes to sudo-
       bugs@courtesan.com.  Be sure to include the version of
       ssssuuuuddddoooo you are using and the platform you are running it on.

DDDDIIIISSSSCCCCLLLLAAAAIIIIMMMMEEEERRRR
       SSSSuuuuddddoooo is provided ``AS IS'' and any express or implied
       warranties, including, but not limited to, the implied
       warranties of merchantability and fitness for a particular
       purpose are disclaimed.  See the LICENSE file distributed
       with ssssuuuuddddoooo for complete details.

CCCCAAAAVVVVEEEEAAAATTTTSSSS
       There is no easy way to prevent a user from gaining a root
       shell if that user has access to commands allowing shell
       escapes.

       If users have sudo ALL there is nothing to prevent them
       from creating their own program that gives them a root
       shell regardless of any '!'  elements in the user
       specification.




17/Aug/1999                    1.6                              4





SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)


       Running shell scripts via ssssuuuuddddoooo can expose the same kernel
       bugs that make setuid shell scripts unsafe on some
       operating systems.

SSSSEEEEEEEE AAAALLLLSSSSOOOO
       _s_u_d_o_e_r_s(5), _v_i_s_u_d_o(8), _s_u(1).



















































17/Aug/1999                    1.6                              5