SUDOERS(5) sudo-rs SUDOERS(5) sudoers - sudo sudo-rs sudo . /etc/sudoers . SUDOERS . sudo-rs sudo (Todd Miller) . sudoers sudo . root . su sudo-rs ( root) . rootpw . sudo-rs . (user-ID) ( ) ( ). sudo ( timestamp_timeout ). sudo-rs . sudo-rs ( ) . syslog(3) . sudo-rs . sudo-rs env_reset . . HOME SHELL LOGNAME USER SUDO_* . DISPLAY PATH TERM env_check env_keep . . PATH TERM . LOGNAME USER . ( ) . LOGNAME USER . . () bash . env_check env_keep `*' . (wildcard) . sudoers secure_path. PAM . PAM sudo-rs . env_keep PAM . set-user-ID ( sudo) . _RLD* DYLD_* LD_* LDR_* LIBPATH SHLIB_PATH . sudo sudo . sudo . PAM pam_limits.so . BSD /etc/login.conf . . SUDOERS sudoers : ( ) ( ). . ( ). sudoers - (EBNF) sudoers . EBNF EBNF . EBNF . symbol ::= definition | alternate1 | alternate2 ... . EBNF . "" . ? Means that the preceding symbol (or group of symbols) is optional. That is, it may appear once or not at all. * Means that the preceding symbol (or group of symbols) may appear zero or more times. + Means that the preceding symbol (or group of symbols) may appear one or more times. . ('') ( ) . (Aliases) : User_Alias Runas_Alias Host_Alias Cmnd_Alias. Alias ::= 'User_Alias' User_Alias_Spec (':' User_Alias_Spec)* | 'Runas_Alias' Runas_Alias_Spec (':' Runas_Alias_Spec)* | 'Host_Alias' Host_Alias_Spec (':' Host_Alias_Spec)* | 'Cmnd_Alias' Cmnd_Alias_Spec (':' Cmnd_Alias_Spec)* | 'Cmd_Alias' Cmnd_Alias_Spec (':' Cmnd_Alias_Spec)* User_Alias ::= NAME User_Alias_Spec ::= User_Alias '=' User_List Runas_Alias ::= NAME Runas_Alias_Spec ::= Runas_Alias '=' Runas_List Host_Alias ::= NAME Host_Alias_Spec ::= Host_Alias '=' Host_List Cmnd_Alias ::= NAME Cmnd_Alias_Spec ::= Cmnd_Alias '=' Cmnd_List NAME ::= [A-Z]([A-Z][0-9]_)* : Alias_Type NAME = item1, item2, ... Alias_Type User_Alias Runas_Alias Host_Alias Cmnd_Alias . NAME ('_') . NAME . (`:') . Alias_Type NAME = item1, item2, item3 : NAME = item4, item5 . User_List ::= User | User ',' User_List User ::= '!'* user name | '!'* #user-ID | '!'* %group | '!'* %#group-ID | '!'* User_Alias User_List ( `#') ( `%' `%#') User_Alias . `!' . `!' . Runas_List ::= Runas_Member | Runas_Member ',' Runas_List Runas_Member ::= '!'* user name | '!'* #user-ID | '!'* %group | '!'* %#group-ID | '!'* Runas_Alias Runas_List User_List User_Alias Runas_Alias . . () () . ( root toor) (#0 ) . Host_List ::= Host | Host ',' Host_List Host ::= '!'* host name | '!'* Host_Alias Host_List . `!' . Cmnd_List ::= Cmnd | Cmnd ',' Cmnd_List command name ::= file name | file name args ['*'] | file name '""' Cmnd ::= '!'* command name | '!'* directory | '!'* Cmnd_Alias '!'* "list" '!'* "sudoedit" [file name] Cmnd_List . ( ) ( ). . . "" '*' . . `/' . Cmnd_List ( ). Cmnd Cmnd . `\' (escape) : `,', `:', `=', `\'. sudo : "list" "sudoedit". sudoers . "list" -U sudo . "sudo -l -U otheruser". "list" . root root -U . "list" . "sudoedit" sudo -e ( sudoedit) . . "sudoedit" sudo sudoers . /usr/bin/sudoedit sudoedit . "sudoedit" . (Defaults) Default_Entry . . . Cmnd_Alias . Default_Type ::= 'Defaults' | 'Defaults' '@' Host_List | 'Defaults' ':' User_List | 'Defaults' '!' Cmnd_List | 'Defaults' '>' Runas_List Default_Entry ::= Default_Type Parameter_List Parameter_List ::= Parameter | Parameter ',' Parameter_List Parameter ::= Parameter '=' Value | Parameter '+=' Value | Parameter '-=' Value | '!'* Parameter . `!' . . ("") . (`\') . . `\n' `\\\\n' sudoers . sudoers fnmatch(3) . += -=. . -= . : runas . Defaults SUDOERS . (User specification) User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \ (':' Host_List '=' Cmnd_Spec_List)* Cmnd_Spec_List ::= Cmnd_Spec | Cmnd_Spec ',' Cmnd_Spec_List Cmnd_Spec ::= Runas_Spec? Chdir_Spec? Tag_Spec* Cmnd Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')' Chdir_Spec ::= 'CWD=directory' Tag_Spec ::= ('PASSWD:' | 'NOPASSWD:' | 'SETENV:' | 'NOSETENV:' 'EXEC:' | 'NOEXEC') AppArmor_Spec ::= 'APPARMOR_PROFILE=profile' ( ) . root . : "who where = (as_whom) what" ( = ( ) ). : Runas_Spec Runas_Spec / . Runas_Spec Runas_List ( ) (`:') . Runas_List -u . -g ( ). Runas_List Runas_List . . Runas_List Runas_List . Runas_List . Runas_Spec root root . Runas_Spec . : dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm dgb /bin/ls /bin/kill /usr/bin/lprm boulder -- operator. $ sudo -u operator /bin/ls Runas_Spec . : dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm dgb /bin/ls operator /bin/kill /usr/bin/lprm root . dgb /bin/ls operator : dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\ /usr/bin/lprm Runas_Spec . . sudoers : $ sudo -u operator /bin/ls $ sudo -u operator -g operator /bin/ls $ sudo -g operator /bin/ls tcm dialer : tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\ /usr/local/bin/minicom tcm . : $ sudo -g dialer /usr/bin/cu Runas_Spec -u -g . : alan ALL = (root, bin : operator, system) ALL alan root bin operator system . Chdir_Spec CWD . `/' `~' "*". "*" sudo -D . -i . ~user/path/name . runas . Tag_Spec . : PASSWD NOPASSWD SETENV NOSETENV. Cmnd Cmnd Cmnd_Spec_List ( PASSWD NOPASSWD NOSETENV SETENV ). EXEC NOEXEC NOEXEC . aaron /usr/bin/more /usr/bin/vi (shell escapes) . aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi NOEXEC . PASSWD NOPASSWD sudo . NOPASSWD . Runas_Spec NOPASSWD Cmnd_Spec_List . PASSWD . : queen rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm queen /bin/kill /bin/ls /usr/bin/lprm root "rushmore" . queen /bin/kill : queen rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm NOPASSWD "sudo -l" . "sudo -v" NOPASSWD . SETENV NOSETENV setenv . SETENV env_reset -E . env_check env_delete env_keep . . ALL SETENV NOSETENV . AppArmor_Spec sudo-rs AppArmor sudoers (profile) AppArmor . AppArmor sudoers . . AppArmor aa_change_profile(2) . (Wildcards) sudo ( meta glob) sudoers . glob(3) fnmatch(3) IEEE Std 1003.1 ("POSIX.1") . * Matches any set of zero or more characters (including white space). ? Matches any single character (including white space). [...] Matches any character in the specified range. [!...] Matches any character not in the specified range. \x For any character `x', evaluates to `x'. This is used to escape special characters such as: `*', `?', `[', and `]'. . . -- sudo sudo-rs . '*' " " . sudoers sudoers sudoers @include @includedir @socket. 1.9.1 sudo #include #includedir . (include file) sudoers . /etc/sudoers /etc/sudoers.local . /etc/sudoers.local /etc/sudoers /etc/sudoers : @include /etc/sudoers.local sudo (/etc/sudoers) /etc/sudoers.local . /etc/sudoers.local /etc/sudoers . . . (`\') . ("") . `\\' . ( `/' ) sudoers . /etc/sudoers : @include sudoers.local @includedir sudoers.d sudoers . : @includedir /etc/sudoers.d sudo /etc/sudoers.d `~' `.' . . /etc/sudoers.d/01_first /etc/sudoers.d/10_second . /etc/sudoers.d/1_whoops /etc/sudoers.d/10_second . . @includedir . @include visudo @includedir . visudo -f . sudoers . @socket . : @socket (sssd:sssd) /var/run/providers/sudoers.socket sudo . sudoers . : @include @includedir @socket . . (#) . sudo ( ) . . POSIX . visudo . sudo . (`#') ( #include ). . ALL . Cmnd_Alias User_Alias Runas_Alias Host_Alias . ALL . ALL . (`!') (NOT) Cmnd . . `!' . root : ALL,!root ALL, : !root root . "" . `!' ALL " " ( ). (`=', `:', `(', `)') . ( ) (`\') : `!', `=', `:', `,', `(', `)', `\'. SUDOERS sudo Default_Entry . Defaults . (Boolean Flags): o log_allowed sudoers (syslog) . . o noexec sudo NOEXEC EXEC . EXEC NOEXEC . . o noninteractive_auth ( -n sudo ) . . . . . o env_editor visudo SUDO_EDITOR VISUAL EDITOR . visudo root visudo root . "" editor . visudo SUDO_EDITOR VISUAL EDITOR editor . env_reset SUDO_EDITOR VISUAL / EDITOR env_keep env_editor visudo sudo . . o pwfeedback sudo return ( enter) . sudo . pwfeedback sudo . TAB . . o rootpw sudo root . . o setenv env_check env_delete env_keep . . . o targetpw sudo -u ( root) . (user-ID) passwd -u . . o umask_override sudo umask sudoers . umask sudoers umask . umask_override sudo umask umask sudoers . . o use_pty sudo (pseudo-terminal) ( / ). sudo use_pty . sudo . . . (Integers): o passwd_tries sudo . . : o timestamp_timeout sudo . .. . . o umask . 0777 umask sudo . umask_override umask umask umask 0022 . sudo umask . umask umask PAM . umask umask PAM . umask PAM sudoedit PAM . (Strings) o editor (`:') sudoedit visudo . sudoedit SUDO_EDITOR VISUAL EDITOR . visudo visudo SUDO_EDITOR VISUAL EDITOR . sudoedit sudo SUDO_EDITOR VISUAL EDITOR env_keep . /usr/bin/editor:/usr/bin/nano:/usr/bin/vi . FreeBSD /usr/bin/vi . o timestamp_type sudo-rs . timestamp_type . : tty ppid. global kernel . o ppid: ( ) . ( ) ( timestamp_timeout ). sudo . o tty: . ppid . . tty . : o apparmor_profile AppArmor . apparmor_profile sudoers APPARMOR_PROFILE . sudo-rs AppArmor . . o runcwd sudo . "*" -D sudo . Chdir_Spec . o secure_path sudo PATH . PATH /usr/sbin . . : o env_check "" . TZ "" `%' `/' . printf . TZ : o It consists of a fully-qualified path name, optionally prefixed with a colon (`:'), that does not match the location of the zoneinfo directory. o It contains a .. path element. o It contains white space or non-printable characters. o It is longer than the value of PATH_MAX. . = += -= ! . env_reset env_check . sudo root -V . o env_keep env_reset . sudo . . = += -= ! . sudo root -V . HOME . HOME env_keep sudo . sudo sudoedit ( sudo -e) . (LOG FORMAT) sudo-rs syslog(3) . (FILES) /etc/sudoers-rs ( sudo-rs sudo ) /etc/sudoers ( sudo) /run/sudo/ts sudoers (SECURITY NOTES) `!' "" ALL `!' . . : bill ALL = ALL, !SU, !SHELLS SU SHELLS bill . ( ). sudo ALL `!' root ( ). fast_glob sudo-rs fast_glob globbing ( ) . fnmatch Rust . . sudoers: john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\ /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root john fast_glob /usr/bin ./passwd root /usr/bin/passwd root . (Preventing shell escapes) sudo . (shell escapes) sudo . ( ) ( less) . sudo-rs noexec sudo seccomp() . noexec . sudo-rs sudo . . root ( ) . NOEXEC . exec io_uring exec() . /proc/self/mem . noexec . (Timestamp file checks) sudo-rs ( /run/sudo/ts) root root . sudo-rs . . sudo-rs sudo timestamp_timeout . sudo-rs ( ) . sudo-rs . su(1), fnmatch(3), glob(3), sudo(8), visudo(8) (CAVEATS) sudoers visudo . sudoers sudo . (BUGS) sudo-rs : https://github.com/trifectatechfoundation/sudo-rs/issues/ sudoers(5) (Todd Miller) https://www.sudo.ws/ . sudo-rs " " . sudo-rs 0.2.15 SUDOERS(5)