SUDO.CONF(5) SUDO.CONF(5) (NAME) sudo.conf - sudo (DESCRIPTION) /etc/sudo.conf sudo (plugins) . sudo.conf : Plugin (approval) (audit) / (I/O logging) (security policy). Path (plugin-agnostic). Set disable_coredump group_source. Debug sudo sudoreplay visudo sudoers. (#) . . (\) . . Plugin Path Debug Set . sudo.conf C . (Plugin configuration) sudo / . I/O sudo . sudo.conf . Plugin Plugin symbol_name path (dynamic shared object) . symbol_name struct approval_plugin struct audit_plugin struct io_plugin struct policy_plugin . Plugin . path . plugin_dir Path /usr/libexec/sudo . : Plugin sudoers_policy sudoers.so : Plugin sudoers_policy /usr/libexec/sudo/sudoers.so sudo path . : Plugin sudoers_policy sudoers.so 1.8.5 sudo path open . sudoers : Plugin sudoers_policy sudoers.so sudoers_mode=0440 sudoers(5) . . 0 (root) . (policy plugin) . / (I/O plugins) . sudo.conf Plugin sudoers I/O ( ) . : Plugin sudoers_policy sudoers.so Plugin sudoers_io sudoers.so Plugin sudoers_audit sudoers.so 1.9.1 sudo sudoers (audit plugin) . sudo.conf sudo sudoers . 1.9.0 sudo . sudo sudo_plugin(5) . (Path settings) Path Path . : Path intercept /usr/libexec/sudo/sudo_intercept.so Path noexec /usr/libexec/sudo/sudo_noexec.so Path askpass /usr/X11R6/bin/ssh-askpass . Path 1.8.16 sudo . /etc/sudo.conf : askpass . sudo ( ) . askpass (prompt) . askpass SUDO_ASKPASS . devsearch . tty . Sudo /dev devsearch . : /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev devname _ttyname_dev ( BSD macOS Solaris) . intercept (wrappers) execve(2) execl(3) execle(3) execlp(3) execv(3) execvp(3) execvpe(3) system(3) . intercept LD_PRELOAD . /usr/libexec/sudo/sudo_intercept.so . noexec execve(2) execl(3) execle(3) execlp(3) exect(3) execv(3) execveat(3) execvP(3) execvp(3) execvpe(3) fexecve(3) popen(3) posix_spawn(3) posix_spawnp(3) system(3) wordexp(3) . noexec LD_PRELOAD . /usr/libexec/sudo/sudo_noexec.so . plugin_dir . /usr/libexec/sudo . sesh sesh. sudo SELinux . /usr/libexec/sudo/sesh . (Other settings) sudo.conf : disable_coredump (Core dump) sudo . sudo core dump disable_coredump false sudo.conf : Set disable_coredump false core dump set-user-ID sudo . core sudo core dump set-user-ID . BSD sysctl(8) . coreadm(1m) core dump . 1.8.4 sudo . group_source sudo / . ( NFS). getconf(1) : getconf NGROUPS_MAX . . 1.8.7 sudo sudo . . group_source . group_source : static . . <<>> . 1.8.7 . dynamic . <<>> . . . sudo AIX BSD HP-UX Linux macOS Solaris . macOS 1.9.6 . adaptive . macOS 1.8.7 . sudo : Set group_source static 1.8.7 sudo . max_groups . 1 1024 . . . sudo ( ) . 1.8.7 sudo . 1.8.24 . probe_interfaces sudo IP . IP DNS . . IP : Set probe_interfaces false 1.8.10 sudo . (Debug settings) 1.8.4 sudo sudo . Debug Debug . sudo sudoers subsystem@priority (,) . : Debug sudo /var/log/sudo_debug all@warn,plugin@info warn info . Debug sudo_intercept.so /var/log/intercept_debug all@debug sudo_intercept.so . 1.8.12 sudo Debug . Debug . 1.8.12 ( sudoers.so) . sudoers Debug sudo . : crit err warn notice diag info trace debug. . notice notice . trace debug (function call tracing) . get_user_groups src/sudo.c : sudo[123] -> get_user_groups @ src/sudo.c:385 sudo[123] <- get_user_groups @ src/sudo.c:429 := groups=10,0,5 (->) (PID) . (<-) . . sudo : all args conv edit sudoedit event exec main sudo netif pcomm plugin pty (pseudo-terminal) selinux SELinux util utmp utmp sudoers(5) . (FILES) /etc/sudo.conf sudo (EXAMPLES) # # Default /etc/sudo.conf file # # Sudo plugins: # Plugin plugin_name plugin_path plugin_options ... # # The plugin_path is relative to /usr/libexec/sudo unless # fully qualified. # The plugin_name corresponds to a global symbol in the plugin # that contains the plugin interface structure. # The plugin_options are optional. # # The sudoers plugin is used by default if no Plugin lines are present. #Plugin sudoers_policy sudoers.so #Plugin sudoers_io sudoers.so #Plugin sudoers_audit sudoers.so # # Sudo askpass: # Path askpass /path/to/askpass # # An askpass helper program may be specified to provide a graphical # password prompt for "sudo -A" support. Sudo does not ship with its # own askpass program but can use the OpenSSH askpass. # # Use the OpenSSH askpass #Path askpass /usr/X11R6/bin/ssh-askpass # # Use the Gnome OpenSSH askpass #Path askpass /usr/libexec/openssh/gnome-ssh-askpass # # Sudo device search path: # Path devsearch /dev/path1:/dev/path2:/dev # # A colon-separated list of paths to check when searching for a user's # terminal device. # #Path devsearch /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev # # Sudo command interception: # Path intercept /path/to/sudo_intercept.so # # Path to a shared library containing replacements for the execv() # and execve() library functions that perform a policy check to verify # the command is allowed and simply return an error if not. This is # used to implement the "intercept" functionality on systems that # support LD_PRELOAD or its equivalent. # # The compiled-in value is usually sufficient and should only be changed # if you rename or move the sudo_intercept.so file. # #Path intercept /usr/libexec/sudo/sudo_intercept.so # # Sudo noexec: # Path noexec /path/to/sudo_noexec.so # # Path to a shared library containing replacements for the execv() # family of library functions that just return an error. This is # used to implement the "noexec" functionality on systems that support # LD_PRELOAD or its equivalent. # # The compiled-in value is usually sufficient and should only be changed # if you rename or move the sudo_noexec.so file. # #Path noexec /usr/libexec/sudo/sudo_noexec.so # # Sudo plugin directory: # Path plugin_dir /path/to/plugins # # The default directory to use when searching for plugins that are # specified without a fully qualified path name. # #Path plugin_dir /usr/libexec/sudo # # Core dumps: # Set disable_coredump true|false # # By default, sudo disables core dumps while it is executing (they # are re-enabled for the command that is run). # To aid in debugging sudo problems, you may wish to enable core # dumps by setting "disable_coredump" to false. # #Set disable_coredump false # # User groups: # Set group_source static|dynamic|adaptive # # Sudo passes the user's group list to the policy plugin. # If the user is a member of the maximum number of groups (usually 16), # sudo will query the group database directly to be sure to include # the full list of groups. # # On some systems, this can be expensive so the behavior is configurable. # The "group_source" setting has three possible values: # static - use the user's list of groups returned by the kernel. # dynamic - query the group database to find the list of groups. # adaptive - if user is in less than the maximum number of groups. # use the kernel list, else query the group database. # #Set group_source static # # Sudo interface probing: # Set probe_interfaces true|false # # By default, sudo will probe the system's network interfaces and # pass the IP address of each enabled interface to the policy plugin. # On systems with a large number of virtual interfaces this may take # a noticeable amount of time. # #Set probe_interfaces false # # Sudo debug files: # Debug program /path/to/debug_log subsystem@priority[,subsyste@priority] # # Sudo and related programs support logging debug information to a file. # The program is typically sudo, sudoers.so, sudoreplay, or visudo. # # Subsystems vary based on the program; "all" matches all subsystems. # Priority may be crit, err, warn, notice, diag, info, trace, or debug. # Multiple subsystem@priority may be specified, separated by a comma. # #Debug sudo /var/log/sudo_debug all@warn,plugin@info #Debug sudoers.so /var/log/sudoers_debug all@debug (SEE ALSO) sudo_plugin(5) sudoers(5) sudo(8) (AUTHORS) sudo : Todd C. Miller sudo CONTRIBUTORS.md sudo . (BUGS) sudo . (SUPPORT) sudo-users . (DISCLAIMER) sudo << >> (AS IS) . LICENSE.md sudo . sudo SUDO.CONF(5)