From: Todd C. Miller Date: Tue, 12 Dec 2017 22:42:21 +0000 (-0700) Subject: Try to be clearer about sudo's exit value when the -l option is used. X-Git-Tag: SUDO_1_8_22^2~33 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bda2f4c441728c6c39c48835c559cc8dab367e05;p=sudo Try to be clearer about sudo's exit value when the -l option is used. --- diff --git a/doc/sudo.cat b/doc/sudo.cat index d4231dce4..84ec77d02 100644 --- a/doc/sudo.cat +++ b/doc/sudo.cat @@ -231,9 +231,9 @@ DDEESSCCRRIIPPTTIIOONN If a _c_o_m_m_a_n_d is specified and is permitted by the security policy, the fully-qualified path to the command is displayed - along with any command line arguments. If _c_o_m_m_a_n_d is - specified but not allowed, ssuuddoo will exit with a status value - of 1. + along with any command line arguments. If a _c_o_m_m_a_n_d is + specified but not allowed by the policy, ssuuddoo will exit with + a status value of 1. --nn, ----nnoonn--iinntteerraaccttiivvee Avoid prompting the user for input of any kind. If a @@ -458,15 +458,21 @@ CCOOMMMMAANNDD EEXXEECCUUTTIIOONN EEXXIITT VVAALLUUEE Upon successful execution of a command, the exit status from ssuuddoo will be the exit status of the program that was executed. If the command - terminated due to receipt of a signal, ssuuddoo will send itself the signal - that terminated the command. - - Otherwise, ssuuddoo exits with a value of 1 if there is a - configuration/permission problem or if ssuuddoo cannot execute the given - command. In the latter case, the error string is printed to the standard - error. If ssuuddoo cannot stat(2) one or more entries in the user's PATH, an - error is printed to the standard error. (If the directory does not exist - or if it is not really a directory, the entry is ignored and no error is + terminated due to receipt of a signal, ssuuddoo will send itself the same + signal that terminated the command. + + If the --ll option was specified without a command, ssuuddoo will exit with a + value of 0 if the user is allowed to run ssuuddoo and they authenticated + successfully (as required by the security policy). If a command is + specified with the --ll option, the exit value will only be 0 if the + command is permitted by the security policy, otherwise it will be 1. + + If there is an authentication failure, a configuration/permission problem + or if the given command cannot be executed, ssuuddoo exits with a value of 1. + In the latter case, the error string is printed to the standard error. + If ssuuddoo cannot stat(2) one or more entries in the user's PATH, an error + is printed to the standard error. (If the directory does not exist or if + it is not really a directory, the entry is ignored and no error is printed.) This should not happen under normal circumstances. The most common reason for stat(2) to return "permission denied" is if you are running an automounter and one of the directories in your PATH is on a diff --git a/doc/sudo.man.in b/doc/sudo.man.in index 973a44984..5d01f57f3 100644 --- a/doc/sudo.man.in +++ b/doc/sudo.man.in @@ -460,9 +460,9 @@ If a is specified and is permitted by the security policy, the fully-qualified path to the command is displayed along with any command line arguments. -If +If a \fIcommand\fR -is specified but not allowed, +is specified but not allowed by the policy, \fBsudo\fR will exit with a status value of 1. .TP 12n @@ -896,14 +896,24 @@ Upon successful execution of a command, the exit status from will be the exit status of the program that was executed. If the command terminated due to receipt of a signal, \fBsudo\fR -will send itself the signal that terminated the command. +will send itself the same signal that terminated the command. .PP -Otherwise, +If the +\fB\-l\fR +option was specified without a command, \fBsudo\fR -exits with a value of 1 if there is a configuration/permission -problem or if +will exit with a value of 0 if the user is allowed to run +\fBsudo\fR +and they authenticated successfully (as required by the security policy). +If a command is specified with the +\fB\-l\fR +option, the exit value will only be 0 if the command is permitted by the +security policy, otherwise it will be 1. +.PP +If there is an authentication failure, a configuration/permission +problem or if the given command cannot be executed, \fBsudo\fR -cannot execute the given command. +exits with a value of 1. In the latter case, the error string is printed to the standard error. If \fBsudo\fR diff --git a/doc/sudo.mdoc.in b/doc/sudo.mdoc.in index 85d739c69..07c9ae7e0 100644 --- a/doc/sudo.mdoc.in +++ b/doc/sudo.mdoc.in @@ -419,9 +419,9 @@ If a is specified and is permitted by the security policy, the fully-qualified path to the command is displayed along with any command line arguments. -If +If a .Ar command -is specified but not allowed, +is specified but not allowed by the policy, .Nm will exit with a status value of 1. .It Fl n , -non-interactive @@ -825,14 +825,24 @@ Upon successful execution of a command, the exit status from will be the exit status of the program that was executed. If the command terminated due to receipt of a signal, .Nm -will send itself the signal that terminated the command. +will send itself the same signal that terminated the command. .Pp -Otherwise, +If the +.Fl l +option was specified without a command, .Nm -exits with a value of 1 if there is a configuration/permission -problem or if +will exit with a value of 0 if the user is allowed to run +.Nm +and they authenticated successfully (as required by the security policy). +If a command is specified with the +.Fl l +option, the exit value will only be 0 if the command is permitted by the +security policy, otherwise it will be 1. +.Pp +If there is an authentication failure, a configuration/permission +problem or if the given command cannot be executed, .Nm -cannot execute the given command. +exits with a value of 1. In the latter case, the error string is printed to the standard error. If .Nm