Document negated sudoHost entries.

diff --git a/doc/sudoers.ldap.cat b/doc/sudoers.ldap.cat
index 6f0e75f00b0c9a29b8d5a38c7176c79c93224f9a..3f57e315989956e4fdd7f0d288a89349afe74b59 100644 (file)
--- a/doc/sudoers.ldap.cat
+++ b/doc/sudoers.ldap.cat
@@ -80,7 +80,9 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
            with a `+').  The special value ALL will match any host.  Host
            netgroups are matched using the host (both qualified and
            unqualified) and domain members only; the user member is not used
-           when matching.
+           when matching.  If a sudoHost entry is preceded by an exclamation
+           point, `!', and the entry matches, the sudoRole in which it resides
+           will be ignored.
 
      s\bsu\bud\bdo\boC\bCo\bom\bmm\bma\ban\bnd\bd
            A fully-qualified Unix command name with optional command line

diff --git a/doc/sudoers.ldap.man.in b/doc/sudoers.ldap.man.in
index 5737f04531dc852a2243dd6b0962f1b5a1b309e7..1c6b9b7e31af16273b5b810c235789d6d69ef9af 100644 (file)
--- a/doc/sudoers.ldap.man.in
+++ b/doc/sudoers.ldap.man.in
@@ -167,6 +167,13 @@ The special value
 will match any host.
 Host netgroups are matched using the host (both qualified and unqualified)
 and domain members only; the user member is not used when matching.
+If a
+\fRsudoHost\fR
+entry is preceded by an exclamation point,
+\(oq\&!\(cq,
+and the entry matches, the
+\fRsudoRole\fR
+in which it resides will be ignored.
 .TP 6n
 \fBsudoCommand\fR
 A fully-qualified Unix command name with optional command line arguments,

diff --git a/doc/sudoers.ldap.mdoc.in b/doc/sudoers.ldap.mdoc.in
index 47721bdf9da3db5af8579f976dcf423579a9e34d..4b6ca4afe3b855d54b5e89867ea583f74876de71 100644 (file)
--- a/doc/sudoers.ldap.mdoc.in
+++ b/doc/sudoers.ldap.mdoc.in
@@ -159,6 +159,13 @@ The special value
 will match any host.
 Host netgroups are matched using the host (both qualified and unqualified)
 and domain members only; the user member is not used when matching.
+If a
+.Li sudoHost
+entry is preceded by an exclamation point,
+.Ql \&! ,
+and the entry matches, the
+.Li sudoRole
+in which it resides will be ignored.
 .It Sy sudoCommand
 A fully-qualified Unix command name with optional command line arguments,
 potentially including globbing characters (aka wild cards).