TEXT   58

sudo.txt

Guest on 4th August 2021 01:43:54 AM

  1.                                     1.5.7
  2.  
  3.  NAME
  4.       sudo - execute a command as the superuser
  5.  
  6.  SYNOPSIS
  7.       sudo -V | -h | -l | -v | -k | -s | -H | [ -b ] | [ -p prompt ] [ -u
  8.       username/#uid] command
  9.  
  10.  DESCRIPTION
  11.       sudo allows a permitted user to execute a command as the superuser
  12.       (real and effective uid and gid are set to 0 and root's group as set
  13.       in the passwd file respectively).
  14.  
  15.       sudo determines who is an authorized user by consulting the file
  16.       /etc/sudoers.  By giving sudo the -v flag a user can update the time
  17.       stamp without running a command.  The password prompt itself will also
  18.       time out if the password is not entered with N minutes (again, this is
  19.       defined at installation time and defaults to 5 minutes).
  20.  
  21.       If an unauthorized user executes sudo, mail will be sent from the user
  22.       to the local authorities (defined at installation time).
  23.  
  24.       sudo was designed to log via the 4.3 BSD syslog(3) facility but can
  25.       log to a file instead if so desired (or to both syslog and a file).
  26.  
  27.  OPTIONS
  28.       sudo accepts the following command line options:
  29.  
  30.       -V  The -V (version) option causes sudo to print the version number
  31.           and exit.
  32.  
  33.       -l  The -l (list) option will list out the allowed and forbidden
  34.           commands for the user on the current host.
  35.  
  36.       -h  The -h (help) option causes sudo to print the version of sudo and
  37.           a usage message before exiting.
  38.  
  39.       -v  If given the -v (validate) option, sudo will update the user's
  40.           timestamp file, prompting for a password if necessary.  This
  41.           extends the sudo timeout to for another N minutes (where N is
  42.           defined at installation time and defaults to 5 minutes) but does
  43.           not run a command.
  44.  
  45.       -k  The -k (kill) option to sudo removes the user's timestamp file,
  46.           thus requiring a password the next time sudo is run.  This option
  47.           does not require a password and was added to allow a user to
  48.           revoke sudo permissions from a .logout file.
  49.  
  50.       -b  The -b (background) option tells sudo to run the given command in
  51.           the background.  Note that if you use the -b option you cannot use
  52.  
  53.                                     - 1 -       Formatted:  January 21, 1999
  54.  
  55.  sudo(8)                          5/Nov/98                           sudo(8)
  56.  MAINTENANCE COMMANDS                                   MAINTENANCE COMMANDS
  57.  
  58.                                     1.5.7
  59.  
  60.           shell job control to manipulate the command.
  61.  
  62.       -p  The -p (prompt) option allows you to override the default password
  63.           prompt and use a custom one.  If the password prompt contains the
  64.           %u escape, %u will be replaced by the user's login name.
  65.           Similarly, %h will be replaced by the local hostname.
  66.  
  67.       -u  The -u (user) option causes sudo to run the specified command as a
  68.           user other than root.  To specify a uid instead of a username, use
  69.           "#uid".
  70.  
  71.       -s  The -s (shell) option runs the shell specified by the SHELL
  72.           environment variable if it is set or the shell as specified in
  73.           passwd(5).
  74.  
  75.       -H  The -H (HOME) option sets the HOME environment variable to the
  76.           homedir of the target user (root by default) as specified in
  77.           passwd(5).
  78.  
  79.       --  The -- flag indicates that sudo should stop processing command
  80.           line arguments.  It is most useful in conjunction with the -s
  81.           flag.
  82.  
  83.  RETURN VALUES
  84.       sudo quits with an exit value of 1 if there is a
  85.       configuration/permission problem or if sudo cannot execute the given
  86.       command.  In the latter case the error string is printed to stderr via
  87.       perror(3).  If sudo cannot stat(2) one or more entries in the user's
  88.       PATH the error is printed on stderr via perror(3).  (If the directory
  89.       does not exist or if it is not really a directory, the entry is
  90.       ignored and no error is printed.)  This should not happen under normal
  91.       circumstances.  The most common reason for stat(3) to return
  92.       "permission denied" is if you are running an automounter and one of
  93.       the directories in your PATH is on a machine that is currently
  94.       unreachable.
  95.  
  96.  SECURITY NOTES
  97.       sudo tries to be safe when executing external commands.  Variables
  98.       that control how dynamic loading and binding is done can be used to
  99.       subvert the program that sudo runs.  To combat this the LD_*,
  100.       SHLIB_PATH (HP-UX only), LIBPATH (AIX only), and _RLD_* environment
  101.       variables are removed from the environment passed on to all commands
  102.       executed.  sudo will also remove the IFS, ENV, BASH_ENV and KRB_CONF
  103.       variables as they too can pose a threat.
  104.  
  105.       To prevent command spoofing, sudo checks "." and "" (both denoting
  106.       current directory) last when searching for a command in the user's
  107.       PATH (if one or both are in the PATH).  Note, however, that the actual
  108.       PATH environment variable is not modified and is passed unchanged to
  109.  
  110.                                     - 2 -       Formatted:  January 21, 1999
  111.  
  112.  sudo(8)                          5/Nov/98                           sudo(8)
  113.  MAINTENANCE COMMANDS                                   MAINTENANCE COMMANDS
  114.  
  115.                                     1.5.7
  116.  
  117.       the program that sudo executes.
  118.  
  119.       For security reasons, if your OS supports shared libraries, sudo
  120.       should always be statically linked unless the dynamic loader disables
  121.       user-defined library search paths for setuid programs.  (Most modern
  122.       dynamic loaders do this.)
  123.  
  124.       sudo will check the ownership of its timestamp directory
  125.       (/var/run/sudo or /tmp/.odus by default) and ignore the directory's
  126.       contents if it is not owned by root and only read, writable, and
  127.       executable by root.  On systems that allow users to give files away to
  128.       root (via chown), if the timestamp directory is located in a directory
  129.       writable by anyone (ie: /tmp), it is possible for a user to create the
  130.       timestamp directory before sudo is run.  However, because sudo checks
  131.       the ownership and mode of the directory, the only damage that can be
  132.       done is to "hide" files by putting them in the timestamp dir.  This is
  133.       unlikely to happen since once the timestamp dir is owned by root and
  134.       inaccessible by any other user the user placing files there would be
  135.       unable to get them back out.  To get around this issue you can use a
  136.       directory that is not world-writable for the timestamps (/var/adm/sudo
  137.       for instance).
  138.  
  139.       sudo will not honor timestamp files set far in the future.  Timestamp
  140.       files with a date greater than current_time + 2 * TIMEOUT will be
  141.       ignored and sudo will log the anomaly.  This is done to keep a user
  142.       from creating his/her own timestamp file with a bogus date.
  143.  
  144.  FILES
  145.        /etc/sudoers           file of authorized users.
  146.  
  147.  ENVIRONMENT VARIABLES
  148.        PATH                   Set to a sane value if SECURE_PATH is set
  149.        SHELL                  Used to determine shell to run with -s option
  150.        USER                   Set to the target user (root unless the -u option
  151.                               is specified)
  152.        HOME                   In -s mode, set to homedir of root (or runas user)
  153.                               if built with the SHELL_SETS_HOME option
  154.        SUDO_PROMPT            Replaces the default password prompt
  155.        SUDO_COMMAND           Set to the command run by sudo
  156.        SUDO_USER              Set to the login of the user who invoked sudo
  157.        SUDO_UID               Set to the uid of the user who invoked sudo
  158.        SUDO_GID               Set to the gid of the user who invoked sudo
  159.        SUDO_PS1               If set, PS1 will be set to its value
  160.  
  161.  AUTHORS
  162.       Many people have worked on sudo over the years, this version consists
  163.       of code written primarily by:
  164.  
  165.                                     - 3 -       Formatted:  January 21, 1999
  166.  
  167.  sudo(8)                          5/Nov/98                           sudo(8)
  168.  MAINTENANCE COMMANDS                                   MAINTENANCE COMMANDS
  169.  
  170.                                     1.5.7
  171.  
  172.               Jeff Nieusma
  173.               David Hieb
  174.               Todd Miller
  175.               Chris Jepeway
  176.  
  177.       See the HISTORY file in the sudo distribution for more details.
  178.  
  179.       Please send all bugs, comments, and changes to sudo-
  180.       bugs@courtesan.com.
  181.  
  182.  DISCLAIMER
  183.       This program is distributed in the hope that it will be useful, but
  184.       WITHOUT ANY WARRANTY; without even the implied warranty of
  185.       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  186.       General Public License for more details.
  187.  
  188.       You should have received a copy of the GNU General Public License
  189.       along with this program; if not, write to the Free Software
  190.       Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  191.  
  192.  CAVEATS
  193.       There is no easy way to prevent a user from gaining a root shell if
  194.       that user has access to commands allow shell escapes.
  195.  
  196.       If users have sudo ALL there is nothing to prevent them from creating
  197.       their own program that gives them a root shell regardless of any '!'
  198.       elements in the user specification.
  199.  
  200.       Running shell scripts via sudo can expose the same kernel bugs that
  201.       make setuid shell scripts unsafe on some operating systems.
  202.  
  203.  SEE ALSO
  204.       sudoers(5), visudo(8), su(1).
  205.  
  206.                                     - 4 -       Formatted:  January 21
  207.  
  208.  sudo(8)                                                                           sudo(8)
  209.  MAINTENANCE COMMANDS                                   MAINTENANCE COMMANDS
  210.  
  211.                                     1.5.7
  212.  
  213.                                     - 5 -       Formatted:  January 21

Raw Paste


Login or Register to edit or fork this paste. It's free.