From: Todd C. Miller <Todd.Miller@courtesan.com>
Date: Sun, 1 Feb 2004 20:20:55 +0000 (+0000)
Subject: Mention that disabling "root_sudo" is pretty pointless.
X-Git-Tag: SUDO_1_6_8~193
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c892061f0e461ada7947f7e4e8db2d26548920d6;p=sudo

Mention that disabling "root_sudo" is pretty pointless.
---

diff --git a/sudoers.pod b/sudoers.pod
index 52bfbf604..9edd4f703 100644
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -312,8 +312,11 @@ This flag is I<on> by default.
 
 If set, root is allowed to run B<sudo> too.  Disabling this prevents users
 from "chaining" B<sudo> commands to get a root shell by doing something
-like C<"sudo sudo /bin/sh">.
-This flag is I<on> by default.
+like C<"sudo sudo /bin/sh">.  Note, however, that turning off I<root_sudo>
+will also prevent root and from running B<sudoedit>.
+Disabling I<root_sudo> provides no real additional security; it
+exists purely for historical reasons.
+This flag is I<@root_sudo@> by default.
 
 =item log_host