From ec77318e329585079f51128994f337d966cd1287 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Fri, 11 Jun 2010 18:34:24 -0400 Subject: [PATCH] Leave rules to build .man.in and .cat files uncommented but only make them part of the "all" rule in devel mode. Generate .cat files directly from .man.in instead of .man using default values in configure.in --- configure | 54 +++-- configure.in | 35 +-- doc/Makefile.in | 113 ++++----- doc/sudo.cat | 206 ++++++++-------- doc/sudo.man.in | 2 +- doc/sudo_plugin.cat | 32 +-- doc/sudo_plugin.man.in | 2 +- doc/sudoers.cat | 516 ++++++++++++++++++++-------------------- doc/sudoers.ldap.cat | 24 +- doc/sudoers.ldap.man.in | 2 +- doc/sudoers.man.in | 10 +- doc/sudoreplay.cat | 10 +- doc/sudoreplay.man.in | 2 +- doc/visudo.cat | 6 +- doc/visudo.man.in | 2 +- 15 files changed, 517 insertions(+), 499 deletions(-) diff --git a/configure b/configure index d3de88d05..da73d0c40 100755 --- a/configure +++ b/configure @@ -2779,6 +2779,10 @@ $as_echo "$as_me: Configuring Sudo version $PACKAGE_VERSION" >&6;} +# +# Begin initial values for man page substitution +# +timedir=/var/run/sudo timeout=5 password_timeout=5 sudo_umask=0022 @@ -2794,8 +2798,8 @@ mail_no_user=on mail_no_host=off mail_no_perms=off mailto=root -mailsub='*** SECURITY information for %h ***' -badpass_message='Sorry, try again.' +mailsub="*** SECURITY information for %h ***" +badpass_message="Sorry, try again." fqdn=off runas_default=root env_editor=off @@ -2804,7 +2808,15 @@ tty_tickets=off insults=off root_sudo=on path_info=on +ldap_conf=/etc/ldap.conf +ldap_secret=/etc/ldap.secret +netsvc_conf=/etc/netsvc.conf +noexec_file=/usr/local/libexec/sudo_noexec.so +nsswitch_conf=/etc/nsswitch.conf secure_path="not set" +# +# End initial values for man page substitution +# INSTALL_NOEXEC= devdir='$(srcdir)' PROGS="sudo" @@ -4102,11 +4114,11 @@ if test "${with_ldap_conf_file+set}" = set; then : withval=$with_ldap_conf_file; fi +test -n "$with_ldap_conf_file" && ldap_conf="$with_ldap_conf_file" cat >>confdefs.h <>confdefs.h < conftest.$ac_ext - (eval echo "\"\$as_me:6599: $ac_compile\"" >&5) + (eval echo "\"\$as_me:6611: $ac_compile\"" >&5) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&5 - (eval echo "\"\$as_me:6602: $NM \\\"conftest.$ac_objext\\\"\"" >&5) + (eval echo "\"\$as_me:6614: $NM \\\"conftest.$ac_objext\\\"\"" >&5) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&5 - (eval echo "\"\$as_me:6605: output\"" >&5) + (eval echo "\"\$as_me:6617: output\"" >&5) cat conftest.out >&5 if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" @@ -7807,7 +7819,7 @@ ia64-*-hpux*) ;; *-*-irix6*) # Find out which ABI we are using. - echo '#line 7810 "configure"' > conftest.$ac_ext + echo '#line 7822 "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? @@ -9199,11 +9211,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:9202: $lt_compile\"" >&5) + (eval echo "\"\$as_me:9214: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:9206: \$? = $ac_status" >&5 + echo "$as_me:9218: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. @@ -9538,11 +9550,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:9541: $lt_compile\"" >&5) + (eval echo "\"\$as_me:9553: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:9545: \$? = $ac_status" >&5 + echo "$as_me:9557: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. @@ -9643,11 +9655,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:9646: $lt_compile\"" >&5) + (eval echo "\"\$as_me:9658: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:9650: \$? = $ac_status" >&5 + echo "$as_me:9662: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -9698,11 +9710,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:9701: $lt_compile\"" >&5) + (eval echo "\"\$as_me:9713: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:9705: \$? = $ac_status" >&5 + echo "$as_me:9717: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -12065,7 +12077,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 12068 "configure" +#line 12080 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -12161,7 +12173,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 12164 "configure" +#line 12176 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -15933,8 +15945,6 @@ fi done -netsvc_conf='/etc/netsvc.conf' -nsswitch_conf='/etc/nsswitch.conf' if test ${with_netsvc-"no"} != "no"; then cat >>confdefs.h < $@ +.SUFFIXES: -@DEV@sudo.man.in: $(srcdir)/sudo.man.in +varsub: $(top_srcdir)/configure.in + printf 's#@%s@#1#\ns#@%s@#1#\ns#@%s@#1#\ns#@%s@#/etc#g\ns#@%s@#/usr/local#g\ns#@%s@#4#g\ns#@%s@#1m#g\n' SEMAN BAMAN LCMAN sysconfdir prefix mansectform mansectsu > $@; sed -n '/Begin initial values for man page substitution/,/End initial values for man page substitution/{;p;}' $(top_srcdir)/configure.in | sed -e '/^#/d' -e 's/^/s#@/' -e 's/=[\\"]*/@#/' -e 's/[\\"]*$$/#g/' >> $@ -@DEV@$(srcdir)/sudo.man.in: $(srcdir)/sudo.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" | perl -p sudo.man.pl >> $@ ) +$(srcdir)/sudo.man.in: $(srcdir)/sudo.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" | perl -p sudo.man.pl >> $@ ) sudo.man: $(srcdir)/sudo.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@sudo.cat: $(srcdir)/sudo.cat +$(srcdir)/sudo.cat: varsub $(srcdir)/sudo.man.in + sed -f varsub $(srcdir)/sudo.man.in | $(NROFF) -man > $@ -@DEV@$(srcdir)/sudo.cat: sudo.man +visudo.man.in: $(srcdir)/visudo.man.in -@DEV@visudo.man.in: $(srcdir)/visudo.man.in - -@DEV@$(srcdir)/visudo.man.in: $(srcdir)/visudo.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' visudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" visudo.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) +$(srcdir)/visudo.man.in: $(srcdir)/visudo.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' visudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" visudo.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) visudo.man: $(srcdir)/visudo.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@visudo.cat: $(srcdir)/visudo.cat - -@DEV@$(srcdir)/visudo.cat: visudo.man +$(srcdir)/visudo.cat: varsub $(srcdir)/visudo.man.in + sed -f varsub $(srcdir)/visudo.man.in | $(NROFF) -man > $@ -@DEV@sudoers.man.in: $(srcdir)/sudoers.man.in +sudoers.man.in: $(srcdir)/sudoers.man.in -@DEV@$(srcdir)/sudoers.man.in: $(srcdir)/sudoers.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" | perl -p sudoers.man.pl >> $@ ) +$(srcdir)/sudoers.man.in: $(srcdir)/sudoers.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" | perl -p sudoers.man.pl >> $@ ) -sudoers.man:: $(srcdir)/sudoers.man.in +sudoers.man: $(srcdir)/sudoers.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@sudoers.cat: $(srcdir)/sudoers.cat +$(srcdir)/sudoers.cat: varsub $(srcdir)/sudoers.man.in + sed -f varsub $(srcdir)/sudoers.man.in | $(NROFF) -man > $@ -@DEV@$(srcdir)/sudoers.cat: sudoers.man +sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.man.in -@DEV@sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.man.in +$(srcdir)/sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.ldap.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.ldap.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) -@DEV@$(srcdir)/sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.ldap.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.ldap.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) - -sudoers.ldap.man:: $(srcdir)/sudoers.ldap.man.in +sudoers.ldap.man: $(srcdir)/sudoers.ldap.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@sudoers.ldap.cat: $(srcdir)/sudoers.ldap.cat - -@DEV@$(srcdir)/sudoers.ldap.cat: sudoers.ldap.man +$(srcdir)/sudoers.ldap.cat: varsub $(srcdir)/sudoers.ldap.man.in + sed -f varsub $(srcdir)/sudoers.ldap.man.in | $(NROFF) -man > $@ -@DEV@sudoreplay.man.in: $(srcdir)/sudoreplay.man.in +sudoreplay.man.in: $(srcdir)/sudoreplay.man.in -@DEV@$(srcdir)/sudoreplay.man.in: $(srcdir)/sudoreplay.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoreplay.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoreplay.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) +$(srcdir)/sudoreplay.man.in: $(srcdir)/sudoreplay.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoreplay.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoreplay.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) -sudoreplay.man:: $(srcdir)/sudoreplay.man.in +sudoreplay.man: $(srcdir)/sudoreplay.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@sudoreplay.cat: $(srcdir)/sudoreplay.cat - -@DEV@$(srcdir)/sudoreplay.cat: sudoreplay.man +$(srcdir)/sudoreplay.cat: varsub $(srcdir)/sudoreplay.man.in + sed -f varsub $(srcdir)/sudoreplay.man.in | $(NROFF) -man > $@ -@DEV@sudo_plugin.man.in: $(srcdir)/sudo_plugin.man.in +sudo_plugin.man.in: $(srcdir)/sudo_plugin.man.in -@DEV@$(srcdir)/sudo_plugin.man.in: $(srcdir)/sudo_plugin.pod -@DEV@ @rm -f $(srcdir)/$@ -@DEV@ ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo_plugin.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo_plugin.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) +$(srcdir)/sudo_plugin.man.in: $(srcdir)/sudo_plugin.pod + @rm -f $(srcdir)/$@ + ( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo_plugin.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo_plugin.pod | sed -e "s/(5)/($$mansectform)/g" -e "s/(8)/($$mansectsu)/g" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ ) -sudo_plugin.man:: $(srcdir)/sudo_plugin.man.in +sudo_plugin.man: $(srcdir)/sudo_plugin.man.in (cd $(top_builddir) && $(SHELL) config.status --file=doc/$@) -@DEV@sudo_plugin.cat: $(srcdir)/sudo_plugin.cat +$(srcdir)/sudo_plugin.cat: varsub $(srcdir)/sudo_plugin.man.in + sed -f varsub $(srcdir)/sudo_plugin.man.in | $(NROFF) -man > $@ -@DEV@$(srcdir)/sudo_plugin.cat: sudo_plugin.man +HISTORY: history.pod + pod2text -l -i0 $> > $@ -@DEV@HISTORY: history.pod -@DEV@ pod2text -l -i0 $> > $@ -@DEV@ -@DEV@LICENSE: license.pod -@DEV@ pod2text -l -i0 $> | sed '1,2d' > $@ +LICENSE: license.pod + pod2text -l -i0 $> | sed '1,2d' > $@ install: install-dirs install-man @@ -173,6 +173,7 @@ check: @echo nothing to check clean: + -rm -f varsub mostlyclean: clean diff --git a/doc/sudo.cat b/doc/sudo.cat index a2ad93fc2..b301deb11 100644 --- a/doc/sudo.cat +++ b/doc/sudo.cat @@ -17,8 +17,8 @@ SSYYNNOOPPSSIISS [--pp _p_r_o_m_p_t] [--UU _u_s_e_r _n_a_m_e] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d] ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--DD _l_e_v_e_l] [--cc _c_l_a_s_s|_-] - [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] - [--ii | --ss] [_c_o_m_m_a_n_d] + [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--rr _r_o_l_e] [--tt _t_y_p_e] + [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] [--ii | --ss] [_c_o_m_m_a_n_d] ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-] [--DD _l_e_v_e_l] [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] file ... @@ -41,9 +41,10 @@ DDEESSCCRRIIPPTTIIOONN ssuuddoo determines who is an authorized user by consulting the file _/_e_t_c_/_s_u_d_o_e_r_s. By running ssuuddoo with the --vv option, a user can update - the time stamp without running a _c_o_m_m_a_n_d. The password prompt itself - will also time out if the user's password is not entered within 5 - minutes (unless overridden via _s_u_d_o_e_r_s). + the time stamp without running a _c_o_m_m_a_n_d. If a password is required, + ssuuddoo will exit if the user's password is not entered within a + configurable time limit. The default password prompt timeout is 5 + minutes. If a user who is not listed in the _s_u_d_o_e_r_s file tries to run a command via ssuuddoo, mail is sent to the proper authorities, as defined at @@ -57,11 +58,10 @@ DDEESSCCRRIIPPTTIIOONN be used by a user to log commands through sudo even when a root shell has been invoked. It also allows the --ee option to remain useful even when being run via a sudo-run script or program. Note however, that - the sudoers lookup is still done for root, not the user specified by -1.8.0a2 June 9, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -70,6 +70,7 @@ DDEESSCCRRIIPPTTIIOONN SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + the sudoers lookup is still done for root, not the user specified by SUDO_USER. ssuuddoo can log both successful and unsuccessful attempts (as well as @@ -123,11 +124,10 @@ OOPPTTIIOONNSS defined in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single '-' character. Specifying a _c_l_a_s_s of - indicates that the command should be run restricted by the default login capabilities for the - user the command is run as. If the _c_l_a_s_s argument -1.8.0a2 June 9, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -136,6 +136,7 @@ OOPPTTIIOONNSS SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + user the command is run as. If the _c_l_a_s_s argument specifies an existing user class, the command must be run as root, or the ssuuddoo command must be run from a shell that is already root. This option is only available on systems @@ -189,11 +190,10 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -H The --HH (_H_O_M_E) option sets the HOME environment variable to the homedir of the target user (root by default) as specified in _p_a_s_s_w_d(4). By default, ssuuddoo does not modify - HOME (see _s_e_t___h_o_m_e and _a_l_w_a_y_s___s_e_t___h_o_m_e in _s_u_d_o_e_r_s(4)). -1.8.0a2 June 9, 2010 3 +1.8.0b1 June 11, 2010 3 @@ -202,6 +202,8 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + HOME (see _s_e_t___h_o_m_e and _a_l_w_a_y_s___s_e_t___h_o_m_e in _s_u_d_o_e_r_s(4)). + -h The --hh (_h_e_l_p) option causes ssuuddoo to print a usage message and exit. @@ -254,12 +256,10 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) required for the command to run, ssuuddoo will display an error messages and exit. - -P The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes ssuuddoo to - preserve the invoking user's group vector unaltered. By -1.8.0a2 June 9, 2010 4 +1.8.0b1 June 11, 2010 4 @@ -268,6 +268,8 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + -P The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes ssuuddoo to + preserve the invoking user's group vector unaltered. By default, ssuuddoo will initialize the group vector to the list of groups the target user is in. The real and effective group IDs, however, are still set to match the target user. @@ -298,6 +300,9 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) system password prompt on systems that support PAM unless the _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag is disabled in _s_u_d_o_e_r_s. + -r _r_o_l_e The --rr (_r_o_l_e) option causes the new (SELinux) security + context to have the role specified by _r_o_l_e. + -S The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password from the standard input instead of the terminal device. The password must be followed by a newline character. @@ -309,30 +314,35 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) the shell for execution. Otherwise, an interactive shell is executed. + -t _t_y_p_e The --tt (_t_y_p_e) option causes the new (SELinux) security + context to have the type specified by _t_y_p_e. If no type is + specified, the default type is derived from the specified + role. + -U _u_s_e_r The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with the --ll option to specify the user whose privileges should be listed. Only root or a user with ssuuddoo ALL on the current - host may use this option. - -u _u_s_e_r The --uu (_u_s_e_r) option causes ssuuddoo to run the specified - command as a user other than _r_o_o_t. To specify a _u_i_d - instead of a _u_s_e_r _n_a_m_e, use _#_u_i_d. When running commands as - a _u_i_d, many shells require that the '#' be escaped with a - backslash ('\'). Note that if the _t_a_r_g_e_t_p_w Defaults option - is set (see _s_u_d_o_e_r_s(4)) it is not possible to run commands - with a uid not listed in the password database. +1.8.0b1 June 11, 2010 5 -1.8.0a2 June 9, 2010 5 +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + host may use this option. + -u _u_s_e_r The --uu (_u_s_e_r) option causes ssuuddoo to run the specified + command as a user other than _r_o_o_t. To specify a _u_i_d + instead of a _u_s_e_r _n_a_m_e, use _#_u_i_d. When running commands as + a _u_i_d, many shells require that the '#' be escaped with a + backslash ('\'). Note that if the _t_a_r_g_e_t_p_w Defaults option + is set (see _s_u_d_o_e_r_s(4)) it is not possible to run commands + with a uid not listed in the password database. -V The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the version number and exit. If the invoking user is already root the @@ -370,6 +380,26 @@ PPLLUUGGIINNSS use the traditional _s_u_d_o_e_r_s security policy and I/O logging, which corresponds to the following _/_e_t_c_/_s_u_d_o_._c_o_n_f file. + + + + + + + + + + + +1.8.0b1 June 11, 2010 6 + + + + + +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + + # # Default /etc/sudo.conf file # @@ -388,18 +418,6 @@ PPLLUUGGIINNSS A Plugin line consists of the Plugin keyword, followed by the _s_y_m_b_o_l___n_a_m_e and the _p_a_t_h to the shared object containing the plugin. The _s_y_m_b_o_l___n_a_m_e is the name of the struct policy_plugin or struct - - - -1.8.0a2 June 9, 2010 6 - - - - - -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) - - io_plugin in the plugin shared object. The _p_a_t_h may be fully qualified or relative. If not fully qualified it is relative to the _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c directory. Any additional parameters after the _p_a_t_h @@ -436,6 +454,18 @@ SSEECCUURRIITTYY NNOOTTEESS If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s, any variables not explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are inherited from the invoking process. In this case, _e_n_v___c_h_e_c_k and + + + +1.8.0b1 June 11, 2010 7 + + + + + +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + + _e_n_v___d_e_l_e_t_e behave like a blacklist. Since it is not possible to blacklist all potentially dangerous environment variables, use of the default _e_n_v___r_e_s_e_t behavior is encouraged. @@ -454,18 +484,6 @@ SSEECCUURRIITTYY NNOOTTEESS ssuuddoo to preserve them. To prevent command spoofing, ssuuddoo checks "." and "" (both denoting - - - -1.8.0a2 June 9, 2010 7 - - - - - -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) - - current directory) last when searching for a command in the user's PATH (if one or both are in the PATH). Note, however, that the actual PATH environment variable is _n_o_t modified and is passed unchanged to the @@ -502,6 +520,18 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) command with ssuuddoo after authenticating, logout, login again, and run ssuuddoo without authenticating so long as the time stamp file's modification time is within 5 minutes (or whatever the timeout is set + + + +1.8.0b1 June 11, 2010 8 + + + + + +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + + to in _s_u_d_o_e_r_s). When the _t_t_y___t_i_c_k_e_t_s option is enabled in _s_u_d_o_e_r_s, the time stamp has per-tty granularity but still may outlive the user's session. On Linux systems where the devpts filesystem is used, Solaris @@ -520,18 +550,6 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) when giving users access to commands via ssuuddoo to verify that the command does not inadvertently give the user an effective root shell. For more information, please see the PREVENTING SHELL ESCAPES section - - - -1.8.0a2 June 9, 2010 8 - - - - - -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) - - in _s_u_d_o_e_r_s(4). EENNVVIIRROONNMMEENNTT @@ -568,6 +586,18 @@ EENNVVIIRROONNMMEENNTT SUDO_USER Set to the login of the user who invoked sudo + + + +1.8.0b1 June 11, 2010 9 + + + + + +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + + USER Set to the target user (root unless the --uu option is specified) @@ -587,17 +617,6 @@ FFIILLEESS EEXXAAMMPPLLEESS Note: the following examples assume suitable _s_u_d_o_e_r_s(4) entries. - - -1.8.0a2 June 9, 2010 9 - - - - - -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) - - To get a file listing of an unreadable directory: $ sudo ls /usr/local/protected @@ -633,6 +652,18 @@ SSEEEE AALLSSOO _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(4), _s_u_d_o_e_r_s(4), _s_u_d_o___p_l_u_g_i_n(1m), _s_u_d_o_r_e_p_l_a_y(1m), _v_i_s_u_d_o(1m) + + + +1.8.0b1 June 11, 2010 10 + + + + + +SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + + AAUUTTHHOORRSS Many people have worked on ssuuddoo over the years; this version consists of code written primarily by: @@ -652,18 +683,6 @@ CCAAVVEEAATTSS It is not meaningful to run the cd command directly via sudo, e.g., - - - -1.8.0a2 June 9, 2010 10 - - - - - -SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) - - $ sudo cd /usr/local/protected since when the command exits the parent process (your shell) will still @@ -702,25 +721,6 @@ DDIISSCCLLAAIIMMEERR - - - - - - - - - - - - - - - - - - - -1.8.0a2 June 9, 2010 11 +1.8.0b1 June 11, 2010 11 diff --git a/doc/sudo.man.in b/doc/sudo.man.in index 165ff0d6a..5be68213c 100644 --- a/doc/sudo.man.in +++ b/doc/sudo.man.in @@ -149,7 +149,7 @@ .\" ======================================================================== .\" .IX Title "SUDO @mansectsu@" -.TH SUDO @mansectsu@ "June 10, 2010" "1.8.0a2" "MAINTENANCE COMMANDS" +.TH SUDO @mansectsu@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/doc/sudo_plugin.cat b/doc/sudo_plugin.cat index 8679a6290..c8405b6f1 100644 --- a/doc/sudo_plugin.cat +++ b/doc/sudo_plugin.cat @@ -61,7 +61,7 @@ SSuuddoo PPlluuggiinn AAPPII -1.8.0a2 June 9, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -127,7 +127,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -193,7 +193,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 3 +1.8.0b1 June 11, 2010 3 @@ -259,7 +259,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 4 +1.8.0b1 June 11, 2010 4 @@ -325,7 +325,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 5 +1.8.0b1 June 11, 2010 5 @@ -391,7 +391,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 6 +1.8.0b1 June 11, 2010 6 @@ -457,7 +457,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 7 +1.8.0b1 June 11, 2010 7 @@ -523,7 +523,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 8 +1.8.0b1 June 11, 2010 8 @@ -589,7 +589,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 9 +1.8.0b1 June 11, 2010 9 @@ -655,7 +655,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 10 +1.8.0b1 June 11, 2010 10 @@ -721,7 +721,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 11 +1.8.0b1 June 11, 2010 11 @@ -787,7 +787,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 12 +1.8.0b1 June 11, 2010 12 @@ -853,7 +853,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 13 +1.8.0b1 June 11, 2010 13 @@ -919,7 +919,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 14 +1.8.0b1 June 11, 2010 14 @@ -985,7 +985,7 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 15 +1.8.0b1 June 11, 2010 15 @@ -1051,6 +1051,6 @@ SUDO_PLUGIN(1m) MAINTENANCE COMMANDS SUDO_PLUGIN(1m) -1.8.0a2 June 9, 2010 16 +1.8.0b1 June 11, 2010 16 diff --git a/doc/sudo_plugin.man.in b/doc/sudo_plugin.man.in index 7dc045581..f4f9fe473 100644 --- a/doc/sudo_plugin.man.in +++ b/doc/sudo_plugin.man.in @@ -139,7 +139,7 @@ .\" ======================================================================== .\" .IX Title "SUDO_PLUGIN @mansectsu@" -.TH SUDO_PLUGIN @mansectsu@ "June 9, 2010" "1.8.0a2" "MAINTENANCE COMMANDS" +.TH SUDO_PLUGIN @mansectsu@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/doc/sudoers.cat b/doc/sudoers.cat index c17aeb05e..f6df430a4 100644 --- a/doc/sudoers.cat +++ b/doc/sudoers.cat @@ -61,7 +61,7 @@ DDEESSCCRRIIPPTTIIOONN -1.8.0a2 June 8, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -127,7 +127,7 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -1.8.0a2 June 8, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -193,7 +193,7 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -1.8.0a2 June 8, 2010 3 +1.8.0b1 June 11, 2010 3 @@ -259,7 +259,7 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -1.8.0a2 June 8, 2010 4 +1.8.0b1 June 11, 2010 4 @@ -275,10 +275,12 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) Cmnd_Spec_List ::= Cmnd_Spec | Cmnd_Spec ',' Cmnd_Spec_List - Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd + Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')' + SELinux_Spec ::= ('ROLE=role' | 'TYPE=type') + Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' | 'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' | 'LOG_OUTPUT:' | 'NOLOG_OUTPUT:') @@ -320,12 +322,10 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) dgb boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm - Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but _/_b_i_n_/_k_i_l_l - and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott. -1.8.0a2 June 8, 2010 5 +1.8.0b1 June 11, 2010 5 @@ -334,6 +334,9 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but _/_b_i_n_/_k_i_l_l + and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott. + We can extend this to allow ddggbb to run /bin/ls with either the user or group set to ooppeerraattoorr: @@ -347,6 +350,13 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) tcm boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \ /usr/local/bin/minicom + SSEELLiinnuuxx__SSppeecc + On systems with SELinux support, _s_u_d_o_e_r_s entries may optionally have an + SELinux role and/or type associated with a command. If a role or type + is specified with the command it will override any default values + specified in _s_u_d_o_e_r_s. A role or type specified on the command line, + however, will supercede the values in _s_u_d_o_e_r_s. + TTaagg__SSppeecc A command may have zero or more tags associated with it. There are eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV, @@ -378,27 +388,27 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) By default, if the NOPASSWD tag is applied to any of the entries for a user on the current host, he or she will be able to run sudo -l without a password. Additionally, a user may only run sudo -v without a - password if the NOPASSWD tag is present for all a user's entries that - pertain to the current host. This behavior may be overridden via the - verifypw and listpw options. - _N_O_E_X_E_C _a_n_d _E_X_E_C - If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying - operating system supports it, the NOEXEC tag can be used to prevent a - dynamically-linked executable from running further commands itself. +1.8.0b1 June 11, 2010 6 -1.8.0a2 June 8, 2010 6 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + password if the NOPASSWD tag is present for all a user's entries that + pertain to the current host. This behavior may be overridden via the + verifypw and listpw options. -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + _N_O_E_X_E_C _a_n_d _E_X_E_C + If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying + operating system supports it, the NOEXEC tag can be used to prevent a + dynamically-linked executable from running further commands itself. In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled. @@ -444,27 +454,28 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) [!...] Matches any character nnoott in the specified range. - \x For any character "x", evaluates to "x". This is used to - escape special characters such as: "*", "?", "[", and "}". - POSIX character classes may also be used if your system's _g_l_o_b(3) and - _f_n_m_a_t_c_h(3) functions support them. However, because the ':' character - has special meaning in _s_u_d_o_e_r_s, it must be escaped. For example: - /bin/ls [[\:alpha\:]]* - Would match any file name beginning with a letter. +1.8.0b1 June 11, 2010 7 -1.8.0a2 June 8, 2010 7 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + \x For any character "x", evaluates to "x". This is used to + escape special characters such as: "*", "?", "[", and "}". -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + POSIX character classes may also be used if your system's _g_l_o_b(3) and + _f_n_m_a_t_c_h(3) functions support them. However, because the ':' character + has special meaning in _s_u_d_o_e_r_s, it must be escaped. For example: + /bin/ls [[\:alpha\:]]* + + Would match any file name beginning with a letter. Note that a forward slash ('/') will nnoott be matched by wildcards used in the path name. When matching the command line arguments, however, a @@ -509,29 +520,29 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s. The #includedir directive can be used to create a _s_u_d_o_._d directory that - the system package manager can drop _s_u_d_o_e_r_s rules into as part of - package installation. For example, given: - #includedir /etc/sudoers.d - ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that - end in ~ or contain a . character to avoid causing problems with - package manager or editor temporary/backup files. Files are parsed in - sorted lexical order. That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed - before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Be aware that because the sorting is - lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr +1.8.0b1 June 11, 2010 8 -1.8.0a2 June 8, 2010 8 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + the system package manager can drop _s_u_d_o_e_r_s rules into as part of + package installation. For example, given: + #includedir /etc/sudoers.d + ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that + end in ~ or contain a . character to avoid causing problems with + package manager or editor temporary/backup files. Files are parsed in + sorted lexical order. That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed + before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Be aware that because the sorting is + lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d. Using a consistent number of leading zeroes in the file names can be used to avoid such problems. @@ -576,28 +587,27 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS earlier. A list of all supported Defaults parameters, grouped by type, are listed below. - BBoooolleeaann FFllaaggss: - - always_set_home If set, ssuuddoo will set the HOME environment variable to - the home directory of the target user (which is root - unless the --uu option is used). This effectively means - that the --HH option is always implied. This flag is _o_f_f - by default. - authenticate If set, users must authenticate themselves via a - password (or other means of authentication) before they +1.8.0b1 June 11, 2010 9 -1.8.0a2 June 8, 2010 9 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + BBoooolleeaann FFllaaggss: + always_set_home If set, ssuuddoo will set the HOME environment variable to + the home directory of the target user (which is root + unless the --uu option is used). This effectively means + that the --HH option is always implied. This flag is _o_f_f + by default. + authenticate If set, users must authenticate themselves via a + password (or other means of authentication) before they may run commands. This default may be overridden via the PASSWD and NOPASSWD tags. This flag is _o_n by default. @@ -642,20 +652,10 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) option causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function, which does not access the file system to do its matching. The disadvantage of _f_a_s_t___g_l_o_b is that it is - unable to match relative path names such as _._/_l_s or - _._._/_b_i_n_/_l_s. This has security implications when path - names that include globbing characters are used with - the negation operator, '!', as such rules can be - trivially bypassed. As such, this option should not be - used when _s_u_d_o_e_r_s contains rules that contain negated - path names which include globbing characters. This - flag is _o_f_f by default. - - fqdn Set this flag if you want to put fully qualified host -1.8.0a2 June 8, 2010 10 +1.8.0b1 June 11, 2010 10 @@ -664,6 +664,16 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + unable to match relative path names such as _._/_l_s or + _._._/_b_i_n_/_l_s. This has security implications when path + names that include globbing characters are used with + the negation operator, '!', as such rules can be + trivially bypassed. As such, this option should not be + used when _s_u_d_o_e_r_s contains rules that contain negated + path names which include globbing characters. This + flag is _o_f_f by default. + + fqdn Set this flag if you want to put fully qualified host names in the _s_u_d_o_e_r_s file. I.e., instead of myhost you would use myhost.mydomain.edu. You may still use the short form if you wish (and even mix the two). Beware @@ -708,27 +718,28 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) long_otp_prompt When validating with a One Time Password (OPT) scheme such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to make it easier to cut and paste the challenge to a - local window. It's not as pretty as the default but - some people find it more convenient. This flag is _o_f_f - by default. - mail_always Send mail to the _m_a_i_l_t_o user every time a users runs - ssuuddoo. This flag is _o_f_f by default. - mail_badpass Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo - does not enter the correct password. This flag is _o_f_f - by default. +1.8.0b1 June 11, 2010 11 -1.8.0a2 June 8, 2010 11 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + local window. It's not as pretty as the default but + some people find it more convenient. This flag is _o_f_f + by default. + mail_always Send mail to the _m_a_i_l_t_o user every time a users runs + ssuuddoo. This flag is _o_f_f by default. + + mail_badpass Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo + does not enter the correct password. This flag is _o_f_f + by default. mail_no_host If set, mail will be sent to the _m_a_i_l_t_o user if the invoking user exists in the _s_u_d_o_e_r_s file, but is not @@ -773,6 +784,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group vector is left unaltered. The real and effective group IDs, however, are still set to match the target user. + + + +1.8.0b1 June 11, 2010 12 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + This flag is _o_f_f by default. pwfeedback By default, ssuuddoo reads the password like most other @@ -785,17 +808,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) able to determine the length of the password being entered. This flag is _o_f_f by default. - - -1.8.0a2 June 8, 2010 12 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - requiretty If set, ssuuddoo will only run when the user is logged in to a real tty. When this flag is set, ssuuddoo can only be run from a login session and not via other means such @@ -838,6 +850,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) the value of _s_e_t___l_o_g_n_a_m_e. This flag is _o_f_f by default. setenv Allow the user to disable the _e_n_v___r_e_s_e_t option from the + + + +1.8.0b1 June 11, 2010 13 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + command line. Additionally, environment variables set via the command line are not subject to the restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or @@ -850,18 +874,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) shell as root (the shell is determined by the SHELL environment variable if it is set, falling back on the shell listed in the invoking user's /etc/passwd entry - - - -1.8.0a2 June 8, 2010 13 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - if not). This flag is _o_f_f by default. stay_setuid Normally, when ssuuddoo executes a command the real and @@ -905,28 +917,27 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) using a unique session ID that is included in the normal ssuuddoo log line, prefixed with _T_S_I_D_=. - Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m) - utility, which can also be used to list or search the - available logs. - - tty_tickets If set, users must authenticate on a per-tty basis. - Normally, ssuuddoo uses a directory in the ticket dir with - the same name as the user running it. With this flag - enabled, ssuuddoo will use a file named for the tty the - user is logged in on in that directory. This flag is - _o_f_f by default. +1.8.0b1 June 11, 2010 14 -1.8.0a2 June 8, 2010 14 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m) + utility, which can also be used to list or search the + available logs. + tty_tickets If set, users must authenticate on a per-tty basis. + Normally, ssuuddoo uses a directory in the ticket dir with + the same name as the user running it. With this flag + enabled, ssuuddoo will use a file named for the tty the + user is logged in on in that directory. This flag is + _o_f_f by default. umask_override If set, ssuuddoo will set the umask as specified by _s_u_d_o_e_r_s without modification. This makes it possible to @@ -971,21 +982,10 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: - loglinelen Number of characters per line for the file log. This - value is used to decide when to wrap lines for nicer - log files. This has no effect on the syslog log file, - only the file log. The default is 80 (use 0 or negate - the option to disable word wrap). - - passwd_timeout Number of minutes before the ssuuddoo password prompt times - out. The timeout may include a fractional component if - minute granularity is insufficient, for example 2.5. - The default is 5; set this to 0 for no password - timeout. -1.8.0a2 June 8, 2010 15 +1.8.0b1 June 11, 2010 15 @@ -994,6 +994,17 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + loglinelen Number of characters per line for the file log. This + value is used to decide when to wrap lines for nicer + log files. This has no effect on the syslog log file, + only the file log. The default is 80 (use 0 or negate + the option to disable word wrap). + + passwd_timeout Number of minutes before the ssuuddoo password prompt times + out, or 0 for no timeout. The timeout may include a + fractional component if minute granularity is + insufficient, for example 2.5. The default is 5. + timestamp_timeout Number of minutes that can elapse before ssuuddoo will ask for a passwd again. The timeout may include a @@ -1038,28 +1049,27 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) LD_PRELOAD or its equivalent. Defaults to _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c_._s_o. - passprompt The default prompt to use when asking for a password; - can be overridden via the --pp option or the SUDO_PROMPT - environment variable. The following percent (`%') - escapes are supported: - - %H expanded to the local host name including the - domain name (on if the machine's host name is fully - qualified or the _f_q_d_n option is set) - %h expanded to the local host name without the domain +1.8.0b1 June 11, 2010 16 -1.8.0a2 June 8, 2010 16 +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + passprompt The default prompt to use when asking for a password; + can be overridden via the --pp option or the SUDO_PROMPT + environment variable. The following percent (`%') + escapes are supported: + %H expanded to the local host name including the + domain name (on if the machine's host name is fully + qualified or the _f_q_d_n option is set) + %h expanded to the local host name without the domain name %p expanded to the user whose password is being asked @@ -1076,6 +1086,12 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) The default value is Password:. + role The default SELinux role to use when constructing a new + security context to run the command. The default role + may be overridden on a per-command basis in _s_u_d_o_e_r_s or + via command line options. This option is only + available whe ssuuddoo is built with SELinux support. + runas_default The default user to run commands as if the --uu option is not specified on the command line. This defaults to root. Note that if _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur @@ -1097,6 +1113,24 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) timestampowner The owner of the timestamp directory and the timestamps stored therein. The default is root. + type The default SELinux type to use when constructing a new + + + +1.8.0b1 June 11, 2010 17 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + + security context to run the command. The default type + may be overridden on a per-command basis in _s_u_d_o_e_r_s or + via command line options. This option is only + available whe ssuuddoo is built with SELinux support. + SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt: askpass The _a_s_k_p_a_s_s option specifies the fully qualified path to a @@ -1114,18 +1148,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) the program being run. Entries in this file should either be of the form VARIABLE=value or export VARIABLE=value. The value may optionally be surrounded by single or double - - - -1.8.0a2 June 8, 2010 17 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - quotes. Variables in this file are subject to other ssuuddoo environment settings such as _e_n_v___k_e_e_p and _e_n_v___c_h_e_c_k. @@ -1158,6 +1180,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) all All the user's _s_u_d_o_e_r_s entries for the current host must have the NOPASSWD flag set to avoid entering a + + + +1.8.0b1 June 11, 2010 18 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + password. always The user must always enter a password to use the --ll @@ -1180,18 +1214,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) mailerflags Flags to use when invoking mailer. Defaults to --tt. - - - -1.8.0a2 June 8, 2010 18 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - mailerpath Path to mail program used to send warning mail. Defaults to the path to sendmail found at configure time. @@ -1224,6 +1246,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) password. always The user must always enter a password to use the --vv + + + +1.8.0b1 June 11, 2010 19 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + option. any At least one of the user's _s_u_d_o_e_r_s entries for the @@ -1246,18 +1280,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) programs. The argument may be a double-quoted, space- separated list or a single value without double-quotes. The list can be replaced, added to, deleted from, or - - - -1.8.0a2 June 8, 2010 19 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - disabled by using the =, +=, -=, and ! operators respectively. Regardless of whether the env_reset option is enabled or disabled, variables specified by @@ -1290,6 +1312,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) with the _-_V option. When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following values for the + + + +1.8.0b1 June 11, 2010 20 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + syslog facility (the value of the ssyysslloogg Parameter): aauutthhpprriivv (if your OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33, llooccaall44, llooccaall55, llooccaall66, and llooccaall77. The following syslog priorities @@ -1309,21 +1343,6 @@ EEXXAAMMPPLLEESS Below are example _s_u_d_o_e_r_s entries. Admittedly, some of these are a bit contrived. First, we define our _a_l_i_a_s_e_s: - - - - - - -1.8.0a2 June 8, 2010 20 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - # User alias specification User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias PARTTIMERS = bostley, jwfox, crawl @@ -1359,6 +1378,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less Here we override some of the compiled in default values. We want ssuuddoo + + + +1.8.0b1 June 11, 2010 21 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility in all cases. We don't want to subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt need not give a password, and we don't want to reset the LOGNAME, USER @@ -1378,18 +1409,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) Defaults!PAGERS noexec The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run - - - -1.8.0a2 June 8, 2010 21 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - what. root ALL = (ALL) ALL @@ -1425,6 +1444,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) operator ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\ sudoedit /etc/printcap, /usr/oper/bin/ + + + +1.8.0b1 June 11, 2010 22 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + The ooppeerraattoorr user may run commands limited to simple maintenance. Here, those are commands related to backups, killing processes, the printing system, shutting down the system, and any commands in the @@ -1445,17 +1476,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) the _H_P_P_A machines. Note that this assumes _p_a_s_s_w_d(1) does not take multiple user names on the command line. - - -1.8.0a2 June 8, 2010 22 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - bob SPARC = (OP) ALL : SGI = (OP) ALL The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user @@ -1490,6 +1510,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) jill SERVERS = /usr/bin/, !SU, !SHELLS For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in + + + +1.8.0b1 June 11, 2010 23 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U and _S_H_E_L_L_S Cmnd_Aliases. @@ -1509,19 +1541,6 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) and wim), may run any command as user www (which owns the web pages) or simply _s_u(1) to www. - - - - -1.8.0a2 June 8, 2010 23 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\ /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM @@ -1557,6 +1576,18 @@ SSEECCUURRIITTYY NNOOTTEESS /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by + + + +1.8.0b1 June 11, 2010 24 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + changing to _/_u_s_r_/_b_i_n and running ./passwd root instead. PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS @@ -1576,18 +1607,6 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS number of programs that offer shell escapes, restricting users to the set of programs that do not if often unworkable. - - - -1.8.0a2 June 8, 2010 24 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - noexec Many systems that support shared libraries have the ability to override default library functions by pointing an environment variable (usually LD_PRELOAD) to an alternate @@ -1623,6 +1642,18 @@ SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) documented in the User Specification section above. Here is that example again: + + + +1.8.0b1 June 11, 2010 25 + + + + + +SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) + + aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i @@ -1642,18 +1673,6 @@ SSEEEE AALLSSOO CCAAVVEEAATTSS The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which - - - -1.8.0a2 June 8, 2010 25 - - - - - -SUDOERS(4) MAINTENANCE COMMANDS SUDOERS(4) - - locks the file and does grammatical checking. It is imperative that _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a syntactically incorrect _s_u_d_o_e_r_s file. @@ -1692,25 +1711,6 @@ DDIISSCCLLAAIIMMEERR - - - - - - - - - - - - - - - - - - - -1.8.0a2 June 8, 2010 26 +1.8.0b1 June 11, 2010 26 diff --git a/doc/sudoers.ldap.cat b/doc/sudoers.ldap.cat index 52950f9d3..b88ba9dad 100644 --- a/doc/sudoers.ldap.cat +++ b/doc/sudoers.ldap.cat @@ -61,7 +61,7 @@ DDEESSCCRRIIPPTTIIOONN -1.8.0a1 May 25, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -127,7 +127,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -193,7 +193,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 3 +1.8.0b1 June 11, 2010 3 @@ -259,7 +259,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 4 +1.8.0b1 June 11, 2010 4 @@ -325,7 +325,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 5 +1.8.0b1 June 11, 2010 5 @@ -391,7 +391,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 6 +1.8.0b1 June 11, 2010 6 @@ -457,7 +457,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 7 +1.8.0b1 June 11, 2010 7 @@ -523,7 +523,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 8 +1.8.0b1 June 11, 2010 8 @@ -589,7 +589,7 @@ EEXXAAMMPPLLEESS -1.8.0a1 May 25, 2010 9 +1.8.0b1 June 11, 2010 9 @@ -655,7 +655,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 10 +1.8.0b1 June 11, 2010 10 @@ -721,7 +721,7 @@ SUDOERS.LDAP(4) MAINTENANCE COMMANDS SUDOERS.LDAP(4) -1.8.0a1 May 25, 2010 11 +1.8.0b1 June 11, 2010 11 @@ -787,6 +787,6 @@ DDIISSCCLLAAIIMMEERR -1.8.0a1 May 25, 2010 12 +1.8.0b1 June 11, 2010 12 diff --git a/doc/sudoers.ldap.man.in b/doc/sudoers.ldap.man.in index 8daaf03b0..f94bd576d 100644 --- a/doc/sudoers.ldap.man.in +++ b/doc/sudoers.ldap.man.in @@ -140,7 +140,7 @@ .\" ======================================================================== .\" .IX Title "SUDOERS.LDAP @mansectform@" -.TH SUDOERS.LDAP @mansectform@ "May 25, 2010" "1.8.0a1" "MAINTENANCE COMMANDS" +.TH SUDOERS.LDAP @mansectform@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in index d95a223ee..3ec34c76a 100644 --- a/doc/sudoers.man.in +++ b/doc/sudoers.man.in @@ -148,7 +148,7 @@ .\" ======================================================================== .\" .IX Title "SUDOERS @mansectform@" -.TH SUDOERS @mansectform@ "June 8, 2010" "1.8.0a2" "MAINTENANCE COMMANDS" +.TH SUDOERS @mansectform@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -1058,10 +1058,10 @@ effect on the syslog log file, only the file log. The default is \&\f(CW\*(C`@loglen@\*(C'\fR (use 0 or negate the option to disable word wrap). .IP "passwd_timeout" 16 .IX Item "passwd_timeout" -Number of minutes before the \fBsudo\fR password prompt times out. -The timeout may include a fractional component if minute granularity -is insufficient, for example \f(CW2.5\fR. The default is \f(CW\*(C`@password_timeout@\*(C'\fR; -set this to \f(CW0\fR for no password timeout. +Number of minutes before the \fBsudo\fR password prompt times out, or +\&\f(CW0\fR for no timeout. The timeout may include a fractional component +if minute granularity is insufficient, for example \f(CW2.5\fR. The +default is \f(CW\*(C`@password_timeout@\*(C'\fR. .IP "timestamp_timeout" 16 .IX Item "timestamp_timeout" Number of minutes that can elapse before \fBsudo\fR will ask for a diff --git a/doc/sudoreplay.cat b/doc/sudoreplay.cat index 65b0a5c5e..ccc48c396 100644 --- a/doc/sudoreplay.cat +++ b/doc/sudoreplay.cat @@ -61,7 +61,7 @@ OOPPTTIIOONNSS -1.8.0a2 May 30, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -127,7 +127,7 @@ SUDOREPLAY(1m) MAINTENANCE COMMANDS SUDOREPLAY(1m) -1.8.0a2 May 30, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -193,7 +193,7 @@ SUDOREPLAY(1m) MAINTENANCE COMMANDS SUDOREPLAY(1m) -1.8.0a2 May 30, 2010 3 +1.8.0b1 June 11, 2010 3 @@ -259,7 +259,7 @@ EEXXAAMMPPLLEESS -1.8.0a2 May 30, 2010 4 +1.8.0b1 June 11, 2010 4 @@ -325,6 +325,6 @@ DDIISSCCLLAAIIMMEERR -1.8.0a2 May 30, 2010 5 +1.8.0b1 June 11, 2010 5 diff --git a/doc/sudoreplay.man.in b/doc/sudoreplay.man.in index 65a72f5bd..222dd1f03 100644 --- a/doc/sudoreplay.man.in +++ b/doc/sudoreplay.man.in @@ -139,7 +139,7 @@ .\" ======================================================================== .\" .IX Title "SUDOREPLAY @mansectsu@" -.TH SUDOREPLAY @mansectsu@ "May 30, 2010" "1.8.0a2" "MAINTENANCE COMMANDS" +.TH SUDOREPLAY @mansectsu@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/doc/visudo.cat b/doc/visudo.cat index 576fa64d9..b4af190db 100644 --- a/doc/visudo.cat +++ b/doc/visudo.cat @@ -61,7 +61,7 @@ OOPPTTIIOONNSS -1.8.0a1 May 25, 2010 1 +1.8.0b1 June 11, 2010 1 @@ -127,7 +127,7 @@ AAUUTTHHOORR -1.8.0a1 May 25, 2010 2 +1.8.0b1 June 11, 2010 2 @@ -193,6 +193,6 @@ DDIISSCCLLAAIIMMEERR -1.8.0a1 May 25, 2010 3 +1.8.0b1 June 11, 2010 3 diff --git a/doc/visudo.man.in b/doc/visudo.man.in index ad7e52a74..0754b8c1f 100644 --- a/doc/visudo.man.in +++ b/doc/visudo.man.in @@ -144,7 +144,7 @@ .\" ======================================================================== .\" .IX Title "VISUDO @mansectsu@" -.TH VISUDO @mansectsu@ "May 25, 2010" "1.8.0a1" "MAINTENANCE COMMANDS" +.TH VISUDO @mansectsu@ "June 11, 2010" "1.8.0b1" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l -- 2.40.0