From: Todd C. Miller <Todd.Miller@courtesan.com>
Date: Wed, 26 Sep 2012 18:55:18 +0000 (-0400)
Subject: Mention how !foo is not the same as ALL,!foo
X-Git-Tag: SUDO_1_8_7~1^2~380
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=05896f9cfcf9463f93ac5ede54dc56b683dc6016;p=sudo

Mention how !foo is not the same as ALL,!foo
---

diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index 1ecc8a66b..bc835cef5 100644
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -668,11 +668,24 @@ SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT
      since in a command context, it allows the user to run aannyy command on the
      system.
 
-     An exclamation point (`!') can be used as a logical _n_o_t operator both in
-     an _a_l_i_a_s and in front of a Cmnd.  This allows one to exclude certain
-     values.  Note, however, that using a `!' in conjunction with the built-in
-     AALLLL alias to allow a user to run ``all but a few'' commands rarely works
-     as intended (see _S_E_C_U_R_I_T_Y _N_O_T_E_S below).
+     An exclamation point (`!') can be used as a logical _n_o_t operator in a
+     list or _a_l_i_a_s as well as in front of a Cmnd.  This allows one to exclude
+     certain values.  For the `!' operator to be effective, there must be
+     something for it to exclude.  For example, to match all users except for
+     root one would use:
+
+         ALL,!root
+
+     If the AALLLL, is omitted, as in:
+
+         !root
+
+     it would explicitly deny root but not match any other users.  This is
+     different from a true ``negation'' operator.
+
+     Note, however, that using a `!' in conjunction with the built-in AALLLL
+     alias to allow a user to run ``all but a few'' commands rarely works as
+     intended (see _S_E_C_U_R_I_T_Y _N_O_T_E_S below).
 
      Long lines can be continued with a backslash (`\') as the last character
      on the line.
diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index 703ad2d83..6494bb550 100644
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -1490,11 +1490,37 @@ An exclamation point
 (`\&!')
 can be used as a logical
 \fInot\fR
-operator both in an
+operator in a list or
 \fIalias\fR
-and in front of a
+as well as in front of a
 \fRCmnd\fR.
 This allows one to exclude certain values.
+For the
+`\&!'
+operator to be effective, there must be something for it to exclude.
+For example, to match all users except for root one would use:
+.nf
+.sp
+.RS 4n
+ALL,!root
+.RE
+.fi
+.PP
+If the
+\fBALL\fR,
+is omitted, as in:
+.nf
+.sp
+.RS 4n
+!root
+.RE
+.fi
+.PP
+it would explicitly deny root but not match any other users.
+This is different from a true
+``negation''
+operator.
+.PP
 Note, however, that using a
 `\&!'
 in conjunction with the built-in
diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index cf0d1da6f..8d642d91c 100644
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -1393,11 +1393,31 @@ An exclamation point
 .Pq Ql \&!
 can be used as a logical
 .Em not
-operator both in an
+operator in a list or
 .Em alias
-and in front of a
+as well as in front of a
 .Li Cmnd .
 This allows one to exclude certain values.
+For the
+.Ql \&!
+operator to be effective, there must be something for it to exclude.
+For example, to match all users except for root one would use:
+.Bd -literal -offset 4n
+ALL,!root
+.Ed
+.Pp
+If the
+.Sy ALL ,
+is omitted, as in:
+.Bd -literal -offset 4n
+!root
+.Ed
+.Pp
+it would explicitly deny root but not match any other users.
+This is different from a true
+.Dq negation
+operator.
+.Pp
 Note, however, that using a
 .Ql \&!
 in conjunction with the built-in