SUDOERS(5) File Formats Manual SUDOERS(5) sudoers - sudo /etc/sudoers sudoers sudo . sudo . /etc/sudoers LDAP . SUDOERS FILE FORMAT . sudoers LDAP sudoers.ldap(5) . sudo.conf sudoers sudo sudo.conf(5) . sudo.conf(5) Plugin sudoers I/O . sudo.conf(5) sudoers . Plugin sudoers_audit sudoers.so Plugin sudoers_policy sudoers.so Plugin sudoers_io sudoers.so sudo 1.8.5 sudoers sudo.conf(5) . ( sudoers.so) . sudoers ( ) . sudo 1.9.1 sudoers_audit . sudoers_policy . . : Plugin sudoers_audit sudoers.so sudoers_mode=0400 error_recovery=false : error_recovery=bool error_recovery sudoers sudoers . true () sudoers . false . 1.9.3 . ldap_conf=pathname ldap_conf ldap.conf . ldap_secret=pathname ldap_secret ldap.secret . sudoers_file=pathname sudoers_file sudoers . sudoers_uid=user-ID sudoers_uid sudoers . (user-ID) . sudoers_gid=group-ID sudoers_gid sudoers . (group-ID) ( ). sudoers_mode=mode sudoers_mode sudoers . () . sudo.conf(5), . sudoers sudo . root . su(1), sudoers ( root) . rootpw, targetpw runaspw . sudo . mailto ( ) root . sudo -l -v mail_always mail_badpass . sudo . sudo ( ) . sudo root SUDO_USER sudoers . sudo root . -e sudo . sudoers root SUDO_USER . sudoers . ( ) ( ). sudo ( timestamp_timeout ). sudoers . timestamp_type sudoers . (Logging) sudoers ( ) . log_allowed log_denied . syslog(3) . syslog(3) syslog logfile . EVENT LOGGING . sudoers / . . / I/O LOGGING . 1.9 log_servers / sudo_logsrvd sudo_logsrv.proto(5) . sudoers . sudoers . env_reset . . AIX ( PAM) /etc/environment . HOME, MAIL, SHELL, LOGNAME USER SUDO_* . DISPLAY, PATH TERM, env_check, env_keep . . PATH TERM . LOGNAME USER . ( ) . LOGNAME USER . . `()' env_keep env_check, bash . 1.8.11 . env_reset env_check env_delete . 1.8.21 `()' . 1.8.21 env_delete bash . env_reset . env_check, env_delete, env_keep `*' . . . (`=') . bash : env_keep += "BASH_FUNC_my_func%%=()*" `=()*' bash . Defaults sudoers, sudo root -V . sudo . sudoers always_set_home, secure_path, set_logname, set_home . PAM pam_env sudo PAM . PAM sudoers . env_reset env_keep PAM . env_reset PAM env_delete . set-user-ID sudo. . _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, . sudo sudo . -i ( ) sudoers env_reset. . DISPLAY, PATH TERM HOME, MAIL, SHELL, USER, LOGNAME . AIX ( PAM) /etc/environment . env_keep env_check, . restricted_env_file env_file . restricted_env_file . env_file . . SUDOERS (SUDOERS FILE FORMAT) sudoers : ( ) ( ). . ( ). sudoers - (EBNF) . EBNF . sudoers . PAM pam_limits.so . BSD /etc/login.conf . AIX /etc/security/limits . . core dump sudoers 0 . core dump core . sudoers . rlimit_as, rlimit_core, rlimit_cpu, rlimit_data, rlimit_fsize, rlimit_locks, rlimit_memlock, rlimit_nofile, rlimit_nproc, rlimit_rss, rlimit_stack . sudoers : "value" (soft) (hard) . "infinity" . "soft,hard" . . (`\'). "infinity" . "default" . ( ) sudo . "user" . core dump : Defaults rlimit_core=default sudoers 1.8.7 . EBNF EBNF () . EBNF . . : symbol ::= definition | alternate1 | alternate2 ... . EBNF . "wildcard" . ? ( ) . . * ( ) . + ( ) . . ('') ( ) . (Aliases) : User_Alias, Runas_Alias, Host_Alias Cmnd_Alias. sudo 1.9.0 Cmd_Alias Cmnd_Alias . Alias ::= 'User_Alias' User_Alias_Spec (':' User_Alias_Spec)* | 'Runas_Alias' Runas_Alias_Spec (':' Runas_Alias_Spec)* | 'Host_Alias' Host_Alias_Spec (':' Host_Alias_Spec)* | 'Cmnd_Alias' Cmnd_Alias_Spec (':' Cmnd_Alias_Spec)* | 'Cmd_Alias' Cmnd_Alias_Spec (':' Cmnd_Alias_Spec)* User_Alias ::= NAME User_Alias_Spec ::= User_Alias '=' User_List Runas_Alias ::= NAME Runas_Alias_Spec ::= Runas_Alias '=' Runas_List Host_Alias ::= NAME Host_Alias_Spec ::= Host_Alias '=' Host_List Cmnd_Alias ::= NAME Cmnd_Alias_Spec ::= Cmnd_Alias '=' Cmnd_List NAME ::= [A-Z]([A-Z][0-9]_)* alias : Alias_Type NAME = item1, item2, ... Alias_Type User_Alias, Runas_Alias, Host_Alias, Cmnd_Alias. . NAME (`_'). . NAME . (`:'). : Alias_Type NAME = item1, item2, item3 : NAME = item4, item5 alias . aliases . alias . User_List ::= User | User ',' User_List User ::= '!'* user name | '!'* #user-ID | '!'* %group | '!'* %#group-ID | '!'* +netgroup | '!'* %:nonunix_group | '!'* %:#nonunix_gid | '!'* User_Alias User_List ( `#'), ( `%' `%#' ) ( `+'), ( `%:' `%:#' ) User_Alias . `!' . `!' . user domain host . user name, user-ID, group, group-ID, netgroup, nonunix_group nonunix_gid . \x20 . . nonunix_group nonunix_gid . QAS AD : o : "%:Group Name" o : "%:Group Name@FULLY.QUALIFIED.DOMAIN" o SID : "%:S-1-2-34-5678901234-5678901234-5678901234-567" GROUP PROVIDER PLUGINS . . (`\') . Other special characters and reserved words . Runas_List ::= Runas_Member | Runas_Member ',' Runas_List Runas_Member ::= '!'* user name | '!'* #user-ID | '!'* %group | '!'* %#group-ID | '!'* %:nonunix_group | '!'* %:#nonunix_gid | '!'* +netgroup | '!'* Runas_Alias | '!'* ALL Runas_List User_List User_Alias Runas_Alias . . ( ) ( ) . ( root toor) (#0 ). Runas_Member . Host_List ::= Host | Host ',' Host_List Host ::= '!'* host name | '!'* ip_addr | '!'* network(/netmask)? | '!'* +netgroup | '!'* Host_Alias | '!'* ALL Host_List IP netgroup ( `+) ' . `!' . netgroup ( ) . netmask sudo netmask . netmask IP ( 255.255.255.0 ffff:ffff:ffff:ffff::) CIDR ( 24 64) . ( Wildcards ) hostname fqdn . sudo IP 127.0.0.1 (localhost) . "localhost" . digest ::= [A-Fa-f0-9]+ | [A-Za-z0-9\+/=]+ Digest_Spec ::= "sha224" ':' digest | "sha256" ':' digest | "sha384" ':' digest | "sha512" ':' digest Digest_List ::= Digest_Spec | Digest_Spec ',' Digest_List Cmnd_List ::= Cmnd | Cmnd ',' Cmnd_List command name ::= regex | file name command ::= command name | command name args | command name regex | command name '""' | ALL Edit_Spec ::= "sudoedit" file name+ | "sudoedit" regex | "sudoedit" List_Spec ::= "list" Cmnd ::= Digest_List? '!'* command | '!'* directory | '!'* Edit_Spec | '!'* List_Spec | '!'* Cmnd_Alias Cmnd_List . ( Wildcards ) `^' `$' ( Regular expressions ). `/'. . Cmnd_List, ( ). . `^' `$'. . `""', . Cmnd Cmnd . Cmnd `^' . . `\' : `,', `:', `=', `\'. Cmnd `^' `^' `\'. . sudo : "list" "sudoedit". sudoers . "list" sudo's -U . "sudo -l -U otheruser". "list" . root root user -U . "list" . "sudoedit" sudo -e ( sudoedit) . . "sudoedit" sudo sudoers . /usr/bin/sudoedit "sudoedit" . sudoedit visudo . command Digest_List Digest_Spec . Digest_List SHA-2 . 1.9.0 ALL Digest_List . : sha224 sha256 sha384 sha512. hex base64 (base64 ). SHA-2 hex openssl shasum sha224sum sha256sum sha384sum sha512sum. openssl: $ openssl dgst -sha224 /bin/ls SHA224(/bin/ls)= 118187da8364d490b4a7debbf483004e8f3e053ec954309de2c41a25 openssl base64 : $ openssl dgst -binary -sha224 /bin/ls | openssl base64 EYGH2oNk1JC0p9679IMATo8+BT7JVDCd4sQaJQ== : ( sudo ) . fexecve(2) . sudo fdexec . 1.8.7 . (Defaults) Default_Entry . . . Cmnd_Alias . Default_Type ::= 'Defaults' | 'Defaults' '@' Host_List | 'Defaults' ':' User_List | 'Defaults' '!' Cmnd_List | 'Defaults' '>' Runas_List Default_Entry ::= Default_Type Parameter_List Parameter_List ::= Parameter | Parameter ',' Parameter_List Parameter ::= Parameter '=' Value | Parameter '+=' Value | Parameter '-=' Value | '!'* Parameter flags integer strings lists . `!' . . ("") . (`\') . . `\n' `\\\\n' sudoers . sudoers fnmatch(3) regexec(3) . : `+=' `-='. . `-=' . Defaults : runas . Defaults . Defaults : fqdn, group_plugin, runas_default, sudoers_locale. Defaults SUDOERS OPTIONS . (User specification) User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \ (':' Host_List '=' Cmnd_Spec_List)* Cmnd_Spec_List ::= Cmnd_Spec | Cmnd_Spec ',' Cmnd_Spec_List Cmnd_Spec ::= Runas_Spec? Option_Spec* (Tag_Spec ':')* Cmnd Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')' Option_Spec ::= (SELinux_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec) SELinux_Spec ::= ('ROLE=role' | 'TYPE=type') Date_Spec ::= ('NOTBEFORE=timestamp' | 'NOTAFTER=timestamp') Timeout_Spec ::= 'TIMEOUT=timeout' Chdir_Spec ::= 'CWD=directory' Chroot_Spec ::= 'CHROOT=directory' Tag_Spec ::= ('EXEC' | 'NOEXEC' | 'FOLLOW' | 'NOFOLLOW' | 'LOG_INPUT' | 'NOLOG_INPUT' | 'LOG_OUTPUT' | 'NOLOG_OUTPUT' | 'MAIL' | 'NOMAIL' | 'INTERCEPT' | 'NOINTERCEPT' | 'PASSWD' | 'NOPASSWD' | 'SETENV' | 'NOSETENV') ( ) . root ( runas_default ) . : "who where = (as_whom) what". : Runas (Runas_Spec) Runas_Spec / . Runas_Spec Runas_List ( ) (`:') . Runas_List -u . -g ( ). Runas_List Runas_List . . Runas_List Runas_List . Runas_List . Runas_Spec runas_default (root ) runas_default . Runas_Spec . : dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm dgb /bin/ls, /bin/kill, /usr/bin/lprm boulder-- operator . : $ sudo -u operator /bin/ls Runas_Spec . : dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm dgb /bin/ls operator, /bin/kill /usr/bin/lprm root . dgb /bin/ls operator: : dgb boulder = (operator : operator) /bin/ls, (root) /bin/kill,\ /usr/bin/lprm Runas_Spec . . sudoers : $ sudo -u operator /bin/ls $ sudo -u operator -g operator /bin/ls $ sudo -g operator /bin/ls tcm dialer . tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu,\ /usr/local/bin/minicom tcm. . : $ sudo -g dialer /usr/bin/cu Runas_Spec, -u -g . : alan ALL = (root, bin : operator, system) ALL alan root bin, operator system . (Option_Spec) Cmnd . / SELinux / . Cmnd, Cmnd Cmnd_Spec_List, . sudoers. . ( ) (alias) . SELinux (SELinux_Spec) SELinux sudoers / SELinux . (RBAC) . sudoers. . sudoers . (Date_Spec) sudoers NOTBEFORE NOTAFTER . "Generalized Time" RFC 4517 . `yyyymmddHHMMSSZ' . `Z' (UTC) . `Z ' UTC . `-0500' . `Z' . : 20170214083000Z 2017021408Z 20160315220000-0500 20151201235900 (Timeout_Spec) . . . `7d8h30m10s' . . . . : `7d8h30m10s', `14d', `8h30m', `600s', `3600'. : `12m2w1d', `30s10m4h', `1d2d3h'. 1.8.20 . (Chdir_Spec) CWD . directory `/' `~' "*". . "*" sudo -D . -i . ~user/path/name . runas . 1.9.3 . Chroot (Chroot_Spec) CHROOT . directory `/' `~' "*". . "*" sudo -R . chroot(2) "sandbox" chroot(8) . ~user/path/name . runas . 1.9.3 . (Tag_Spec) . : EXEC, NOEXEC, FOLLOW, NOFOLLOW, LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT, NOLOG_OUTPUT, MAIL, NOMAIL, INTERCEPT, NOINTERCEPT, PASSWD, NOPASSWD, SETENV, NOSETENV. Cmnd, Cmnds Cmnd_Spec_List, ( PASSWD NOPASSWD NOEXEC EXEC). EXEC NOEXEC sudo noexec NOEXEC . aaron /usr/bin/more /usr/bin/vi . aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi NOEXEC Preventing shell escapes . FOLLOW NOFOLLOW 1.8.15 sudoedit sudoedit_follow . FOLLOW NOFOLLOW sudoedit_follow ( ) . sudoedit . LOG_INPUT NOLOG_INPUT log_input . I/O LOGGING . LOG_OUTPUT NOLOG_OUTPUT log_output . I/O LOGGING . MAIL NOMAIL mail_all_cmnds . sudo -l -v . NOMAIL mail_always mail_no_perms . mail_all_cmnds, mail_always, mail_no_perms SUDOERS OPTIONS . PASSWD NOPASSWD sudo . NOPASSWD . Runas_Spec, NOPASSWD Cmnd_Spec_List. . PASSWD . : ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm ray /bin/kill, /bin/ls, /usr/bin/lprm root "rushmore" . ray /bin/kill : ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm PASSWD exempt_group . NOPASSWD `sudo -l' . `sudo -v' NOPASSWD . verifypw listpw . SETENV NOSETENV setenv . SETENV env_reset -E . env_check, env_delete, env_keep. . . ALL, SETENV NOSETENV . INTERCEPT NOINTERCEPT sudo intercept INTERCEPT sudoers sudo . . . . chuck "research" intercept . chuck research = INTERCEPT: ALL INTERCEPT Preventing shell escapes . (Wildcards) sudo wildcards ( meta glob) sudoers . glob(3) fnmatch(3) IEEE Std 1003.1 ("POSIX.1") . * ( ) . ? ( ) . [...] . [!...] . \x `x ' `x' . : `* ' `? ' `[ ' `]'. (regular expression) . . glob(3) fnmatch(3) . `:' sudoers . : /bin/ls [[\:alpha\:]]* . (`/') . : /usr/bin/* /usr/bin/who /usr/bin/X11/xterm . . . . . Wildcards in command arguments . : "" `""' sudoers . sudoedit sudoedit (`/') . (Regular expressions) 1.9.10 . wildcards . sudoers POSIX egrep(1) . regex(7) re_format(7) . "(?i)" . sudoers `^' `$' . . . . . sudoers . sudoers (`#'). john passwd(1) root root . (wildcards) . john ALL = /usr/bin/passwd ^[a-zA-Z0-9_]+$,\ !/usr/bin/passwd root sudoedit . bob /etc/motd, /etc/issue, /etc/hosts . bob ALL = sudoedit ^/etc/(motd|issue|hosts)$ . sid /usr/sbin/groupadd, /usr/sbin/groupmod, /usr/sbin/groupdel, /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel root . sid ALL = ^/usr/sbin/(group|user)(add|mod|del)$ ./useradd ../sbin/useradd . `!', . . . Regular expressions in command names . sudoers sudoers sudoers @include @includedir . sudo 1.9.1 #include #includedir . include sudoers . sudoers /etc/sudoers /etc/sudoers.local . /etc/sudoers.local /etc/sudoers /etc/sudoers: : @include /etc/sudoers.local sudo (/etc/sudoers) /etc/sudoers.local. . /etc/sudoers.local /etc/sudoers . . . 1.9.1 (`\'). . ("" ) . `\\' . ( `/') ) sudoers . /etc/sudoers : @include sudoers.local /etc/sudoers.local. . `%h' . "xerxes" @include /etc/sudoers.%h sudo /etc/sudoers.xerxes. . @includedir sudoers.d sudoers . : @includedir /etc/sudoers.d sudo /etc/sudoers.d `~' `.' . . /etc/sudoers.d/01_first /etc/sudoers.d/10_second. . /etc/sudoers.d/1_whoops /etc/sudoers.d/10_second. . . @includedir . @include, visudo @includedir . visudo -f alias . (`#') ( #include ). . ALL alias . Cmnd_Alias, User_Alias, Runas_Alias, Host_Alias. . alias ALL . ALL . Option_Spec : CHROOT, ROLE, TYPE, TIMEOUT, CWD, NOTBEFORE NOTAFTER. alias . (`!') not alias Cmnd. . . `!' . root : ALL, !root ALL, : !root root . "negation" . `!' ALL " " ( SECURITY NOTES ). (`\') . User Specification (`=', `:', `(', `)') . (`\') ( ): `!', `=', `:', `,', `(', `)', `\'. sudo Default_Entry . Defaults . : always_query_group_plugin group_plugin `%group' . `%:group' group_plugin . off . always_set_home sudo HOME ( runas_default -u ). env_reset HOME env_keep . off . authenticate ( ) . PASSWD NOPASSWD . on . case_insensitive_group sudoers . LDAP AD . on . case_insensitive_user sudoers . LDAP AD . on . closefrom_override -C sudo . off . compress_io sudo I/O zlib . sudo zlib on . exec_background sudo sudo . exec_background ( I/O use_pty ) . ( ) SIGTTIN ( SIGTTOU ) . sudo . sudo . ( ). sudo . . . macOS tcgetattr(3) tcsetattr(3) ( macOS ). SIGTTIN SIGTTOU ( SIGTOP) . su(1) . off . 1.8.7 . I/O use_pty . env_editor visudo SUDO_EDITOR, VISUAL EDITOR . visudo root visudo root . "safe" editor . visudo SUDO_EDITOR, VISUAL EDITOR editor . env_reset SUDO_EDITOR, VISUAL / EDITOR env_keep visudo sudo env_editor . on . env_reset sudo TERM, PATH, HOME, MAIL, SHELL, LOGNAME, USER SUDO_* . restricted_env_file env_keep env_check env_file ( ) . env_keep env_check Defaults sudoers sudo root -V . secure_path PATH . on . fast_glob sudo glob(3) (globbing) . glob(3) (auto mounted) . fast_glob sudo fnmatch(3) . fast_glob ./ls ../bin/ls. . `!', . sudoers . off . log_passwords (echo) . (: I/O LOGGING), I/O . log_passwords sudoers . passprompt_regex (prompt) . I/O `*' (line feed) (carriage return) . ( sudo pwfeedback ) I/O . log_input log_ttyin . on . 1.9.10 . fqdn (FQDN) sudoers ( `hostname' ) . myhost myhost.mydomain.edu . ( ). "canonical" getaddrinfo(3) gethostbyname(3) (FQDN) . DNS . /etc/hosts DNS "canonical" (fully-qualified) . /etc/nsswitch.conf, /etc/netsvc.conf, /etc/host.conf, /etc/resolv.conf . /etc/hosts "canonical" sudoers . hosts "xyzzy" "canonical" . 192.168.1.1 xyzzy.sudo.ws xyzzy hosts fqdn DNS . DNS fqdn sudoers DNS DNS ( ) sudo . hosts "canonical" DNS . DNS ( CNAME) . on . ignore_audit_errors sudoers (audit log) . . . sudoers FreeBSD, Linux macOS Solaris. on . ignore_dot sudo "." "" ( ) PATH PATH . off . ignore_iolog_errors sudoers I/O ( ) . I/O . I/O . off . ignore_logfile_errors sudoers . . . sudoers logfile . on . ignore_local_sudoers LDAP /etc/sudoers . sudoers LDAP . /etc/sudoers. . /etc/sudoers . sudo LDAP sudoOption `cn=defaults' . off . ignore_unknown_defaults sudo Defaults sudoers sudoOption LDAP . off . insults sudo . off . log_allowed sudoers ( ) syslog / . on . 1.8.29 . log_denied sudoers ( ) syslog / . on . 1.8.29 . log_exit_status sudoers syslog / . . off . 1.9.8 . log_host logfile . off . log_input sudo ( sudo ) . I/O . I/O I/O LOGGING . off . log_output sudo ( sudo ) . I/O (pipeline) . I/O I/O LOGGING . off . log_server_keepalive sudo TCP keepalive . keepalive . ignore_iolog_errors ( I/O) ignore_log_errors ( I/O) . on . 1.9.0 . log_server_verify TLS ( log_servers) IP . TLS . on . 1.9.0 . log_stderr sudo . (pipe) . off log_output LOG_OUTPUT . log_stdin sudo . (pipe) . off log_input LOG_INPUT . log_stdout sudo . (pipe) . off log_output LOG_OUTPUT . log_subcmds sudoers execve(2), execl(3), execle(3), execlp(3), execv(3), execvp(3), execvpe(3), system(3) . sudo . off . log_subcmds intercept . Preventing shell escapes . 1.9.8 SELinux RBAC seccomp(2) . log_ttyin sudo . off log_input LOG_INPUT . ssh(1), . log_ttyout sudo . off log_output LOG_OUTPUT . ssh(1), . log_year ( syslog) sudo . off . long_otp_prompt (OTP) S/Key OPIE, . . off . mail_all_cmnds sudo mailto ( sudoedit). ). sudo -l -v mail_badpass . off . mail_always sudo mailto . off . mail_badpass mailto sudo . sudoers mail_all_cmnds, mail_always, mail_no_host, mail_no_perms mail_no_user . off . mail_no_host mailto sudoers . off . mail_no_perms mailto sudo sudoers . off . mail_no_user mailto sudoers . on . match_group_by_gid sudoers ( ). sudoers . sudoers . sudoers sudo . match_group_by_gid . sudoers sudoers . match_group_by_gid sudoers . /etc/group . match_group_by_gid () () . match_group_by_gid sudoers LDAP . off . 1.8.18 . intercept sudo INTERCEPT NOINTERCEPT . INTERCEPT and NOINTERCEPT Preventing shell escapes . off . 1.9.8 SELinux RBAC seccomp(2) . intercept_allow_setid set- user-ID set-group-ID LD_PRELOAD ( ) . sudoers set-user-ID set-group-ID intercept_allow_setid . intercept INTERCEPT . intercept_type trace on off . 1.9.8 . intercept_authenticate . intercept . intercept INTERCEPT . off . 1.9.8 . intercept_verify sudo . execve(2) . sudo /proc/PID/exe execve(2) . SIGKILL . execve(2) sudoers . proc(5) . intercept INTERCEPT intercept_type trace . on . 1.9.12 . netgroup_tuple netgroup netgroup : ( ). sudo netgroup User_List netgroup Host_List . off . noexec sudo NOEXEC EXEC . EXEC and NOEXEC Preventing shell escapes . off . noninteractive_auth ( -n sudo ). . . . off . 1.9.10 . pam_acct_mgmt PAM sudo PAM . PAM . . on . 1.8.28 . pam_rhost PAM sudo PAM pam_rhost . pam_rhost DNS PAM . Solaris Solaris 8 pam_rhost pam_ruser PAM Solaris . Solaris off . 1.9.0 . pam_ruser PAM sudo pam_ruser PAM sudo . on . 1.9.0 . pam_session PAM sudo PAM . sudo -i -s PAM "silent" . . pam_session PAM PAM utmp wtmp . PAM . pam_session, pam_setcred, use_pty log_servers I/O sudo . on . 1.8.7 . pam_setcred PAM sudo . Kerberos . pam_session, pam_setcred, use_pty log_servers I/O sudo . on . 1.8.8 . passprompt_override passprompt SUDO_PROMPT PAM . off . path_info sudo PATH . . PATH sudo . on . preserve_groups sudo . preserve_groups . (group-IDs) . off . pwfeedback sudo (echo) return ( enter) . sudo . pwfeedback sudo . . off . requiretty sudo tty . sudo cron(8) cgi-bin. off . root_sudo root sudo . "" sudo root `sudo sudo /bin/sh'. . root_sudo sudoedit root . root_sudo . on . rootpw sudo root . off . runas_allow_unknown_id runas . Runas_List, ALL . off . 1.8.30 . sudo . runas_check_shell sudo /etc/shells Runas_List . /etc/shells . "bin", . off . 1.8.30 . runaspw sudo runas_default ( root) . off . selinux SELinux (role) (type) SELinux . SELinux . on . set_home sudo -s - HOME ( runas_default -u ). env_reset HOME env_keep . off . set_logname sudo LOGNAME USER ( runas_default -u ). ( RCS) LOGNAME . set_logname . set_logname env_reset env_keep LOGNAME USER. . on . set_utmp sudo utmp ( utmpx) . sudo log_input, log_output, log_stdin, log_stdout, log_stderr, log_ttyin, log_ttyout, use_pty . utmp ( ) tty time type pid . on . setenv env_reset -E . env_check, env_delete, env_keep . . off . shell_noargs sudo -s . root ( SHELL /etc/passwd ). off . stay_setuid sudo (root ). . sudo set-user-ID . set-user-ID . setreuid(2) setresuid(2) . off . sudoedit_checkdir sudoedit . sudoedit . sudoedit root. . sudoedit . on . 1.8.15 . 1.8.16 . sudoedit_follow sudoedit . sudoedit_follow sudoedit . FOLLOW NOFOLLOW . off . 1.8.15 . syslog_pid syslog(3), . off . 1.8.21 . targetpw sudo -u ( runas_default) . passwd -u . off . tty_tickets tty . sudo . . timestamp_type . umask_override sudo umask sudoers . umask sudoers umask . umask_override sudo umask umask sudoers . off . use_netgroups ( `+) ' . sudoers LDAP NETGROUP_BASE /etc/ldap.conf . LDAP . on . use_pty sudo ( / ). sudo use_pty . sudo . . off . user_command_timeouts . . sudoers . Timeout_Spec . off . 1.8.20 . utmp_runas sudo (runas) utmp ( utmpx) . sudo . off . visiblepw sudo (echo) . visiblepw sudo . `ssh somehost sudo ls' ssh(1) tty . off . : closefrom sudo ( 0-2) . closefrom . 3 . command_timeout . Timeout_Spec . 1.8.20 . log_server_timeout . Timeout_Spec . . 1.9.0 . maxseq `%{seq}' I/O ( iolog_dir ). `%{seq}' maxseq . 2176782336 ( "ZZZZZZ") 2176782336 . 2176782336 . maxseq "" sudoers I/O . 1.8.7 . passwd_tries sudo . . syslog_maxlen syslog(3) . IETF RFC 5424 syslog . sudoers BSD syslog . syslog sudoers syslog_maxlen . "(command continued)" . 1.8.19 . : loglinelen . . syslog . ( ). passwd_timeout sudo . 2.5. . timestamp_timeout sudo . 2.5. 15 . 0 . 0 . `sudo -v' `sudo -k' . umask . umask sudoers 0777 . umask_override umask umask umask 0022 . sudo umask . umask sudoers, umask PAM login.conf . umask sudoers, umask PAM login.conf . umask PAM sudoedit, PAM . Strings: authfail_message . `%d' . : "%d incorrect password attempt(s)". badpass_message . "Sorry, try again." . editor (`:') sudoedit visudo. sudoedit, SUDO_EDITOR, VISUAL EDITOR . visudo, visudo SUDO_EDITOR, VISUAL EDITOR . sudoedit, sudo SUDO_EDITOR, VISUAL EDITOR env_keep env_reset . /usr/bin/editor. intercept_type intercept log_subcmds . : dso ( ) execve(2), execl(3), execle(3), execlp(3), execv(3), execvp(3), execvpe(3), system(3) . dso SELinux RBAC sudo's . trace ptrace(2) execve(2) . seccomp(2) . /proc/sys/kernel/seccomp/actions_avail "trap" intercept_type trace dso . trace dso . iolog_dir /. log_input log_output LOG_INPUT LOG_OUTPUT . . : /var/log/sudo-io. (`%') : %{seq} ( 0100A5) 01/00/A5 %{user} %{group} (real group-ID) %{runas_user} ( root) %{runas_group} ( wheel) %{hostname} %{command} strftime(3) . `%' `%%' . iolog_file iolog_dir, / log_input log_output LOG_INPUT LOG_OUTPUT . iolog_file . : `%{seq}'. (`%') iolog_dir . Xs Xs mktemp(3) iolog_dir iolog_file (truncate) iolog_file Xs. . iolog_flush sudo I/O . I/O . off . 1.8.20 . iolog_group I/O. iolog_group iolog_user . iolog_group iolog_user I/O 0 . 1.8.19 . iolog_mode I/O. . . I/O () iolog_mode . 0600 ( ). 1.8.19 . iolog_user I/O. iolog_group . I/O 0 . I/O (NFS) . I/O sudoers 0 NFS . 1.8.19 . lecture_status_dir sudo . sudo . . /var/lib/sudo/lectured . log_server_cabundle (CA bundle) PEM . . log_servers TLS . 1.9.0 . log_server_peer_cert sudo PEM. TLS . sudo_logsrvd, tls_checkpeer false . 1.9.0 . log_server_peer_key sudo PEM. TLS . sudo_logsrvd, tls_checkpeer false . 1.9.0 . mailsub mailto. `%h' . "*** SECURITY information for %h ***" . noexec_file 1.8.1 sudo . noexec sudo.conf(5) . pam_askpass_service PAM -A . -i `sudo' `sudo-i' . pam_service . 1.9.9 . pam_login_service PAM -i . `sudo-i' . pam_service . 1.8.8 . pam_service PAM PAM . pam.conf /etc/pam.d . `sudo' . 1.8.8 . passprompt -p SUDO_PROMPT . (`%') : %H ( fqdn ) %h %p ( rootpw, targetpw runaspw sudoers) %U (: root) %u %% `%' `%' PAM passprompt PAM "Password: " "username's Password: ". . passprompt - . passprompt_override . `[sudo] password for %p: '. role SELinux . sudoers . sudo SELinux . runas_default -u . root. sudoers_locale (locale) sudoers . sudoers . `C'. timestamp_type sudoers . timestamp_type . : global . sudo . ppid ( ) . ( ) timestamp_timeout ( ) . sudo . tty . ppid . timestamp_timeout ( ) . kernel . ppid . timestamp_timeout . OpenBSD . tty . 1.8.21 . timestampdir sudo . . /run/sudo/ts . timestampowner . root . type SELinux . sudoers . sudo SELinux . : admin_flag admin_flag sudo sudo admin . sudo --enable-admin-flag . ~/.sudo_as_admin_successful . env_file env_file . `VARIABLE=value' `export VARIABLE=value' . . . sudo env_keep env_check . exempt_group PATH . `%' . . fdexec sudo . : always . never . digest_only sudoers . digest_only. . . fdexec ($0 ). . /dev/fd/4 /proc/self/fd/4 . SUDO_COMMAND . fdexec . ALL . 1.8.20 . fexecve(2) . group_plugin sudoers . /usr/libexec/sudo . ( ) . (""). sudoers . . "lib", sudoers "/64" /usr/lib/group_plugin.so /usr/lib/64/group_plugin.so. "lib" "lib64" /usr/lib/group_plugin.so /usr/lib/64/group_plugin.so. "64" group_plugin.so group_plugin64.so. : GROUP PROVIDER PLUGINS. lecture . : always . never . once sudo . once . never . never . lecture_file sudo . sudo . listpw sudo -l . : all sudoers NOPASSWD . always -l . any sudoers NOPASSWD . never -l . any . never . any . log_format . : json JSON. JSON . JSON syslog . sudo sudo EVENT LOGGING . syslog(3) logfile ( ) . sudo . logfile sudo ( syslog). . sudo syslog . mailerflags . : -t. mailerpath ( sudo ). sendmail . mailfrom "from" . `@' sudo ("") . sudo . mailto ( sudo ). `@' sudo ("") . root . rlimit_as ( ) . Resource limits . rlimit_core core dump ( ). Resource limits . 0 ( core dump ). rlimit_cpu ( ). Resource limits . rlimit_data (data segment) ( ). Resource limits . rlimit_fsize ( ). Resource limits . rlimit_locks . Resource limits . rlimit_memlock ( ) . Resource limits . rlimit_nofile . Resource limits . rlimit_nproc . Resource limits . rlimit_rss (resident set size) ( ). Resource limits . rlimit_stack ( ). Resource limits . restricted_env_file restricted_env_file . `VARIABLE=value' `export VARIABLE=value'. . . . env_file . env_reset env_check env_keep . env_reset env_delete . restricted_env_file env_file . runchroot sudo . "*" -R sudo . Chroot_Spec . runchroot Defaults chroot . Defaults Cmnd_Spec Chroot_Spec . 1.9.3 . runcwd sudo . "*" -D sudo . Chdir_Spec . 1.9.3 . secure_path sudo PATH . PATH /usr/sbin . exempt_group secure_path . . syslog Syslog syslog ( syslog ). authpriv . syslog : authpriv ( ) auth, daemon, user, local0, local1, local2, local3, local4, local5, local6, local7. syslog_badpri syslog . alert . syslog : alert, crit, debug, emerg, err, info, notice, warning, none. none . syslog_goodpri syslog . notice . syslog syslog_badpri . none . verifypw sudo -v . : all sudoers NOPASSWD . always -v . any sudoers NOPASSWD . never -v . all . never . all. : env_check "". . TZ, "" `%' `/' . printf . TZ : o (`:'), zoneinfo . o .. . o . o PATH_MAX. . . `=', `+=', `-=', `!' . env_reset env_check . sudo root -V . env_delete env_reset . . `=', `+=', `-=', `!' . sudo root -V . set-user-ID ( sudo). . env_keep env_reset . sudo-spawned . . `=', `+=', `-=', `!' . sudo root -V . HOME . HOME env_keep sudo . sudo sudoedit ( sudo -e) . log_servers I/O . sudo_logsrvd sudo_logsrv.proto(5). . "host[:port][(tls)]". . IPv4 IPv6 . tls (TLS) 1.2 1.3 . 1.2 TLS . . 30343 30344 TLS . log_servers ( syslog log_file ) I/O . . ignore_iolog_errors ( I/O) ignore_log_errors ( I/O) . sudo ignore_iolog_errors ( I/O) ignore_log_errors ( I/O) . 1.9.0 . passprompt_regex POSIX . "(?i)", . . log_passwords . : "[Pp]assword[: ]*" 1.9.10 . (GROUP PROVIDER PLUGINS) sudoers . nonunix_group . group_plugin . group_plugin /usr/libexec/sudo . ( ) . ("") . : group_file group_file /etc/group . . /etc/sudo-group : Defaults group_plugin="group_file.so /etc/sudo-group" system_group system_group C getgrnam(3) getgrid(3) . . : Defaults group_plugin=system_group.so (API) sudo_plugin(5) . (EVENT LOGGING) sudoers JSON sudo sudo . sudoers sudoers syslog(3), . . (octal) `#' . `#011' (CR) `#015'. . `#040'. . (''). . . (`\') ( ). sudo ( ): date hostname progname: username : TTY=ttyname ; CHROOT=chroot ; \ PWD=cwd ; USER=runasuser ; GROUP=runasgroup ; TSID=logid ; \ ENV=env_vars COMMAND=command : date . : "MMM, DD, HH:MM:SS". syslog(3), syslog . log_year . hostname sudo . syslog(3). . progname sudo sudoedit. syslog(3). . username sudo. . ttyname ( "console", "tty01", "pts/0") sudo "unknown" . chroot (root) . cwd sudo . runasuser . runasgroup . logid I/O . log_input log_output . env_vars . command . sudoers_locale `C' . . : user NOT in sudoers sudoers . user NOT authorized on host sudoers . command not allowed sudoers . 3 incorrect password attempts . passwd_tries . a password is required -n . sorry, you are not allowed to set the following environment variables sudoers . sudoers . : parse error in /etc/sudoers near line N sudoers . . problem with defaults entries sudoers Defaults . sudo sudoers visudo . timestamp owner (username): No such user timestampowner . unable to open/read /etc/sudoers sudoers . sudoers user-ID 0 . sudoers sudoers . /etc/sudoers "sudoers_uid=N" ( `N' user-ID sudoers ) sudoers Plugin sudo.conf(5) . unable to open /etc/sudoers /etc/sudoers . /etc/sudoers is not a regular file /etc/sudoers . /etc/sudoers is owned by uid N, should be 0 sudoers . sudoers "sudoers_uid=N" ( `N' sudoers ) sudoers Plugin sudo.conf(5) . /etc/sudoers is world writable sudoers . sudoers 0440 ( ). "sudoers_mode" sudoers Plugin sudo.conf(5) . /etc/sudoers is owned by gid N, should be 1 sudoers . sudoers "sudoers_gid=N" ( `N' sudoers ) sudoers Plugin sudo.conf(5) . unable to open /run/sudo/ts/username sudoers . timestampowner root /run/sudo . /run/sudo 0711 . unable to write to /run/sudo/ts/username sudoers . /run/sudo/ts is owned by uid X, should be Y timestampowner. . timestampowner . sudoers . /run/sudo/ts is group writable timestampowner. . 0700 . sudoers . syslog sudoers syslog(3). date, hostname, progname syslog(3) sudoers . . syslog . syslog_maxlen syslog . syslog_maxlen. logfile sudoers /var/log/sudo. sudoers syslog(3), : 1. progname . 2. hostname log_host . 3. log_year . 4. loglinelen ( ) . grep(1) . loglinelen 0 ( `!'), . / (I/O LOGGING) / sudo sudoers / . / sudoers . log_ttyin log_ttyout log_stdin log_stdout log_stderr log_input LOG_INPUT log_ttyin log_stdin . log_output LOG_OUTPUT log_ttyout log_stdout log_stderr . sudo . sudo / . / . / iolog_dir ( /var/log/sudo-io) sudo `TSID=' . iolog_file . log_servers sudo_logsrvd sudo_logsrv.proto(5) . / sudo . sudo . : #!/bin/sh sudo echo testing echo done : $ sh test.sh testing done `sudo echo testing' . `echo done' . $ sh -s < test.sh testing : 1. /dev/null sudo . sudo echo testing < /dev/null 2. . sh test.sh 3. . Defaults!/bin/echo !log_stdin . I/O rsync(1) tar(1) . : Cmnd_Alias COPY_CMDS = /usr/bin/tar, /usr/bin/cpio, /usr/bin/rsync # Log input and output but omit stdin and stdout when copying files. Defaults log_input, log_output Defaults!COPY_CMDS !log_stdin, !log_stdout log_input LOG_INPUT log_stdin. . log_ouput LOG_OUTPUT log_stdout log_stderr. . . / (I/O) I/O : log . (:) : sudo, () sudo . ( ) . log.json JSON . log . log.json sudoreplay(8) log . : timestamp JSON . : seconds nanoseconds. columns . command . lines . runargv JSON execve(2) . runenv JSON execve(2) . rungid (GID) . . rungroup . . runuid (UID) . runuser . submitcwd sudo . submithost . submituser sudo. . ttyname sudo . ttyname . timing . I/O . I/O : 0 1 2 3 4 5 6 sudo 1.8.7 7 ttyin . log_input log_ttyin sudo . . (CR) (LF) . : `gunzip -c ttyin | tr "\r" "\n"' stdin . log_input log_stdin . ttyout ( ). . / . log_output log_ttyout sudo . stdout . log_output log_stdout . stderr . log_output log_stderr . log gzip compress_io . (buffering) I/O . I/O sudo . iolog_flush I/O . I/O sudoreplay(8) . ( ) . log_output LOG_OUTPUT . log_passwords . I/O I/O . I/O maxseq . I/O maxseq, sudoers I/O . (FILES) /etc/sudo.conf Sudo /etc/sudoers /etc/group /etc/netgroup /var/log/sudo-io / (I/O) /run/sudo/ts sudoers /var/lib/sudo/lectured sudoers /etc/environment -i AIX (EXAMPLES) sudoers . . aliases : # X sudo HOME # .Xauthority . HOME # ! Defaults env_keep += "DISPLAY HOME" # (User alias) User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias WEBADMIN = will, wendy, wim # Runas Runas_Alias OP = root, operator Runas_Alias DB = oracle, sybase Runas_Alias ADMINGRP = adm, oper # (Host alias) Host_Alias SPARC = bigtime, eclipse, moet, anchor :\ SGI = grolsch, dandelion, black :\ ALPHA = widget, thalamus, foobar :\ HPPA = boa, nag, python Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias SERVERS = primary, mail, www, ns Host_Alias CDROM = orion, perseus, hercules # (Cmnd alias) Cmnd_Alias DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\ /usr/sbin/restore, /usr/sbin/rrestore,\ sha224:0GomF8mNN3wlDt1HD9XldjJ3SNgpFdbjO1+NsQ== \ /home/operator/bin/start_backups Cmnd_Alias KILL = /usr/bin/kill Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm Cmnd_Alias SHUTDOWN = /usr/sbin/shutdown Cmnd_Alias HALT = /usr/sbin/halt Cmnd_Alias REBOOT = /usr/sbin/reboot Cmnd_Alias SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\ /usr/local/bin/tcsh, /usr/bin/rsh,\ /usr/local/bin/zsh Cmnd_Alias SU = /usr/bin/su Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less . sudo syslog(3) auth . sudo chroot(2) "sandbox" -R . millert LOGNAME USER root. SERVERS Host_Alias, . PAGERS Cmnd_Alias (/usr/bin/more, /usr/bin/pg /usr/bin/less). . sudo ALL . # Override built-in defaults Defaults syslog=auth,runcwd=~ Defaults>root !set_logname Defaults:FULLTIMERS !lecture,runchroot=* Defaults:millert !authenticate Defaults@SERVERS log_year, logfile=/var/log/sudo.log Defaults!PAGERS noexec User specification . root ALL = (ALL) ALL %wheel ALL = (ALL) ALL root wheel . FULLTIMERS ALL = NOPASSWD: ALL (millert, mikef, dowdy) . PARTTIMERS ALL = ALL ( bostley, jwfox, crawl) ( NOPASSWD ). jack CSNETS = ALL jack CSNETS ( 128.138.243.0 128.138.204.0 128.138.242.0) . 128.138.204.0 ( CIDR) C . CSNETS . lisa CUNETS = ALL lisa CUNETS ( B 128.138.0.0) . operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\ sudoedit /etc/printcap, /usr/oper/bin/ operator . /usr/oper/bin/ . Cmnd_Alias DUMPS sha224 /home/operator/bin/start_backups. operator . ( ) sudo . joe ALL = /usr/bin/su operator joe su(1) operator . pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd *root* %opers ALL = (: ADMINGRP) /usr/sbin/ opers /usr/sbin/ ADMINGRP Runas_Alias ( adm oper) . pete root HPPA . `*' . passwd(1) . getopt(3) passwd(1) . : passwd username --expire . bob SPARC = (OP) ALL : SGI = (OP) ALL bob SPARC SGI OP Runas_Alias (root operator) . jim +biglab = ALL jim biglab . sudo "biglab" `+' netgroup . +secretaries ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser secretaries . fred ALL = (DB) NOPASSWD: ALL fred DB Runas_Alias (oracle sybase) . john ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root* ALPHA john su root su(1) . jen ALL, !SERVERS = ALL jen SERVERS Host_Alias (primary mail www ns) . jill SERVERS = /usr/bin/, !SU, !SHELLS SERVERS Host_Alias, jill /usr/bin/ SU SHELLS Cmnd_Aliases . PAGERS Cmnd_Alias /usr/bin noexec . steve CSNETS = (operator) /usr/local/op_commands/ steve /usr/local/op_commands/ operator . matt valkyrie = KILL valkyrie matt (hung) (kill ). WEBADMIN www = (www) ALL, (root) /usr/bin/su www www WEBADMIN User_Alias ( will wendy wim) www ( ) su(1) www . ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\ /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM CD-ROM CDROM Host_Alias ( orion perseus hercules) (mount) (unmount) . . (SECURITY NOTES) ! "" ALL `!' . . : bill ALL = ALL, !SU, !SHELLS bill SU SHELLS . ( ). sudo ALL `!' root ( ). fast_glob fast_glob ( ) . fnmatch(3) C . . sudoers : john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\ /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root john fast_glob /usr/bin `./passwd root' `/usr/bin/passwd root' . sudo sudoers . << >> (TOCTOU) . . `?' `*' . sudoers : %operator ALL = /bin/cat /var/log/messages* : $ sudo cat /var/log/messages.1 : $ sudo cat /var/log/messages /etc/shadow . . : %operator ALL = /bin/cat ^/var/log/messages[^[:space:]]*$ /var/log/messages . sudoers . fast_glob : o . o sudo sudoers . << >> (time of check versus time of use) . . (Shell escapes) sudo . sudo . () . : restrict . sudoedit sudo. . . intercept intercept sudo sudoers . . intercept : dso trace. intercept_type . dso, C . ( LD_PRELOAD) execve(2), execl(3), execle(3), execlp(3), execv(3), execvp(3), execvpe(3), system(3) sudo . . . set-user-ID set-group-ID LD_PRELOAD ( ) sudoers intercept . dso SELinux RBAC sudo's ( ). SELinux LD_PRELOAD sudo . trace, seccomp(2) . ptrace(2) seccomp(2) execve(2) . SELinux RBAC sudo's . execveat(2) fexecve(3), . intercept Solaris *BSD Linux macOS HP-UX 11.x AIX 5.3 . LD_PRELOAD . . INTERCEPT User Specification . : chuck research = INTERCEPT: ALL chuck "research" . sudo. . intercept, intercept . sudoers . execve(2) sudoers . 1.9.12 trace execve(2) . dso . intercept_verify . log . / log_output . . log_subcmds sudoers . / / . sudoreplay(8) / . log_subcmds intercept ( ) . noexec noexec sudo sudo . LD_PRELOAD intercept ( ) . noexec execve(2), execl(3), execle(3), execlp(3), exect(3), execv(3), execveat(3), execvP(3), execvp(3), execvpe(3), fexecve(3), popen(3), posix_spawn(3), posix_spawnp(3), system(3), wordexp(3) . seccomp(2) noexec. . Solaris 10 noexec LD_PRELOAD Solaris . noexec NOEXEC . : aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi aaron /usr/bin/more /usr/bin/vi noexec . ( ) . noexec noexec . . root ( ) . sudoedit ( ). sudoers sudoedit . sudoedit sudoers . . sudoedit (`/') . sudo . -e sudo(8) . operator " " : operator ALL = sudoedit /etc/motd operator sudoedit : $ sudoedit /etc/motd operator root /etc/motd . /etc/motd . sudoedit ( ) . . 1.8.16 sudoedit sudoedit_checkdir root. . 1.8.15 sudoedit sudoedit_follow sudoedit FOLLOW sudoers . sudoers (/run/sudo/ts ) root root. . sudo /tmp; . /run /var/run . sudoers . . sudoers sudo timestamp_timeout . sudoers ( ) . sudoers . current_time + 2 * TIMEOUT sudoers . timestamp_type "tty", . . timestamp_type "global", . . . timestamp_type "ppid", . . (DEBUGGING) .. sudoers . sudo.conf(5) . sudoers sudo : subsystem@priority. : crit, err, warn, notice, diag, info, trace, debug. . notice notice . sudoers : alias User_Alias, Runas_Alias, Host_Alias Cmnd_Alias all audit BSM auth defaults Defaults sudoers env ldap sudoers LDAP logging match netgroup sudoers netif nss (NSS) sudoers parser sudoers perms plugin main . pty rbtree - sssd sudoers SSSD util : Debug sudoers.so /var/log/sudoers_debug match@info,nss@info sudo.conf(5) . ssh(1), su(1), fnmatch(3), glob(3), mktemp(3), strftime(3), sudo.conf(5), sudo_plugin(5), sudoers.ldap(5), sudoers_timestamp(5), sudo(8), visudo(8) sudo : Todd C. Miller CONTRIBUTORS.md sudo (https://www.sudo.ws/about/contributors/) sudo. (CAVEATS) sudoers visudo . sudoers sudo sudo . sudoers . sudo sudoers . ( ) ( ) hostname fqdn sudoers. . sudo, https://bugzilla.sudo.ws/ . (SUPPORT) sudo-users https://www.sudo.ws/mailman/listinfo/sudo-users . (DISCLAIMER) sudo "AS IS" . LICENSE.md sudo https://www.sudo.ws/about/license/ . (C) 1994-1996, 1998-2005, 2007-2023 Todd C. Miller ISC LICENSE.md sudo https://www.sudo.ws/about/license/ . . Sudo 1.9.13p3 January 16, 2023 Sudo 1.9.13p3