Document that in check mode, visudo does not check the owner/mode

on files specified with the -f flag.

diff --git a/doc/visudo.cat b/doc/visudo.cat
index 3f1d76505bdd5a5b787afbae36c2b27a74676b53..aa5c27859a6607407d74df857103844bf8e7102f 100644 (file)
--- a/doc/visudo.cat
+++ b/doc/visudo.cat
@@ -38,8 +38,10 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
      The options are as follows:
 
      -\b-c\bc, -\b--\b-c\bch\bhe\bec\bck\bk
-                 Enable _\bc_\bh_\be_\bc_\bk_\b-_\bo_\bn_\bl_\by mode.  The existing _\bs_\bu_\bd_\bo_\be_\br_\bs file will be
-                 checked for syntax errors, owner and mode.  A message will be
+                 Enable _\bc_\bh_\be_\bc_\bk_\b-_\bo_\bn_\bl_\by mode.  The existing _\bs_\bu_\bd_\bo_\be_\br_\bs file (and any
+                 other files it includes) will be checked for syntax errors.
+                 If the -\b-f\bf option has not been specified, v\bvi\bis\bsu\bud\bdo\bo will also
+                 check the _\bs_\bu_\bd_\bo_\be_\br_\bs file owner and mode.  A message will be
                  printed to the standard output describing the status of
                  _\bs_\bu_\bd_\bo_\be_\br_\bs unless the -\b-q\bq option was specified.  If the check
                  completes successfully, v\bvi\bis\bsu\bud\bdo\bo will exit with a value of 0.
@@ -53,6 +55,9 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
                  used is the specified _\bs_\bu_\bd_\bo_\be_\br_\bs file with ".tmp" appended to
                  it.  In _\bc_\bh_\be_\bc_\bk_\b-_\bo_\bn_\bl_\by mode only, the argument to -\b-f\bf may be `-',
                  indicating that _\bs_\bu_\bd_\bo_\be_\br_\bs will be read from the standard input.
+                 Because the policy is evaluated in its entirety, it is not
+                 sufficient to check an individual _\bs_\bu_\bd_\bo_\be_\br_\bs include file for
+                 syntax errors.
 
      -\b-h\bh, -\b--\b-h\bhe\bel\blp\bp  Display a short help message to the standard output and exit.
 
@@ -212,4 +217,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.22                    February 22, 2017                   Sudo 1.8.22
+Sudo 1.8.22                    December 6, 2017                    Sudo 1.8.22

diff --git a/doc/visudo.man.in b/doc/visudo.man.in
index c878997f940bb497389d69ccee7284d4e8f1348f..f70591c9fd010101de38208c98eca9553dbe099c 100644 (file)
--- a/doc/visudo.man.in
+++ b/doc/visudo.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "VISUDO" "8" "February 22, 2017" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
+.TH "VISUDO" "8" "December 6, 2017" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -130,8 +130,15 @@ Enable
 mode.
 The existing
 \fIsudoers\fR
-file will be
-checked for syntax errors, owner and mode.
+file (and any other files it includes) will be
+checked for syntax errors.
+If the
+\fB\-f\fR
+option has not been specified,
+\fBvisudo\fR
+will also check the
+\fIsudoers\fR
+file owner and mode.
 A message will be printed to the standard output describing the status of
 \fIsudoers\fR
 unless the
@@ -169,6 +176,10 @@ may be
 indicating that
 \fIsudoers\fR
 will be read from the standard input.
+Because the policy is evaluated in its entirety, it is not sufficient
+to check an individual
+\fIsudoers\fR
+include file for syntax errors.
 .TP 12n
 \fB\-h\fR, \fB\--help\fR
 Display a short help message to the standard output and exit.

diff --git a/doc/visudo.mdoc.in b/doc/visudo.mdoc.in
index ae4bd4e46f5fca2b4669a57a60aaf0fab3779c29..85d78fd8321189ca84be34bcd84cf844ef7bbf3d 100644 (file)
--- a/doc/visudo.mdoc.in
+++ b/doc/visudo.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd February 22, 2017
+.Dd December 6, 2017
 .Dt VISUDO @mansectsu@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -127,8 +127,15 @@ Enable
 mode.
 The existing
 .Em sudoers
-file will be
-checked for syntax errors, owner and mode.
+file (and any other files it includes) will be
+checked for syntax errors.
+If the
+.Fl f
+option has not been specified,
+.Nm
+will also check the
+.Em sudoers
+file owner and mode.
 A message will be printed to the standard output describing the status of
 .Em sudoers
 unless the
@@ -165,6 +172,10 @@ may be
 indicating that
 .Em sudoers
 will be read from the standard input.
+Because the policy is evaluated in its entirety, it is not sufficient
+to check an individual
+.Em sudoers
+include file for syntax errors.
 .It Fl h , -help
 Display a short help message to the standard output and exit.
 .It Fl q , -quiet