From fb015fac1ba317cfd3bf26ef5da3bed0190ef492 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Sat, 27 Oct 2018 12:52:17 -0600 Subject: [PATCH] Document that the target user's groups may be specified via the -g option. --- doc/sudo.cat | 6 ++++-- doc/sudo.man.in | 10 +++++++++- doc/sudo.mdoc.in | 10 +++++++++- doc/sudoers.cat | 21 +++++++++++---------- doc/sudoers.man.in | 4 ++-- doc/sudoers.mdoc.in | 4 ++-- 6 files changed, 37 insertions(+), 18 deletions(-) diff --git a/doc/sudo.cat b/doc/sudo.cat index 1fe43bdc0..eb679c1e2 100644 --- a/doc/sudo.cat +++ b/doc/sudo.cat @@ -167,7 +167,9 @@ DDEESSCCRRIIPPTTIIOONN require that the `#' be escaped with a backslash (`\'). If no --uu option is specified, the command will be run as the invoking user. In either case, the primary group will be set - to _g_r_o_u_p. + to _g_r_o_u_p. The _s_u_d_o_e_r_s policy permits any of the target + user's groups to be specified via the --gg option as long as + the --PP option is not in use. --HH, ----sseett--hhoommee Request that the security policy set the HOME environment @@ -736,4 +738,4 @@ DDIISSCCLLAAIIMMEERR file distributed with ssuuddoo or https://www.sudo.ws/license.html for complete details. -Sudo 1.8.26 October 13, 2018 Sudo 1.8.26 +Sudo 1.8.26 October 27, 2018 Sudo 1.8.26 diff --git a/doc/sudo.man.in b/doc/sudo.man.in index 8551a61f0..08049cc57 100644 --- a/doc/sudo.man.in +++ b/doc/sudo.man.in @@ -19,7 +19,7 @@ .\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" -.TH "SUDO" "8" "October 13, 2018" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" +.TH "SUDO" "8" "October 27, 2018" "Sudo @PACKAGE_VERSION@" "System Manager's Manual" .nh .if n .ad l .SH "NAME" @@ -363,6 +363,14 @@ If no option is specified, the command will be run as the invoking user. In either case, the primary group will be set to \fIgroup\fR. +The +\fIsudoers\fR +policy permits any of the target user's groups to be specified via +the +\fB\-g\fR +option as long as the +\fB\-P\fR +option is not in use. .TP 12n \fB\-H\fR, \fB\--set-home\fR Request that the security policy set the diff --git a/doc/sudo.mdoc.in b/doc/sudo.mdoc.in index 28fa7c35c..0de854e6f 100644 --- a/doc/sudo.mdoc.in +++ b/doc/sudo.mdoc.in @@ -18,7 +18,7 @@ .\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" -.Dd October 13, 2018 +.Dd October 27, 2018 .Dt SUDO @mansectsu@ .Os Sudo @PACKAGE_VERSION@ .Sh NAME @@ -330,6 +330,14 @@ If no option is specified, the command will be run as the invoking user. In either case, the primary group will be set to .Ar group . +The +.Em sudoers +policy permits any of the target user's groups to be specified via +the +.Fl g +option as long as the +.Fl P +option is not in use. .It Fl H , -set-home Request that the security policy set the .Ev HOME diff --git a/doc/sudoers.cat b/doc/sudoers.cat index 6d6ae2d4a..9574f6d82 100644 --- a/doc/sudoers.cat +++ b/doc/sudoers.cat @@ -530,15 +530,16 @@ SSUUDDOOEERRSS FFIILLEE FFOORRMMAATT defined above) separated by a colon (`:') and enclosed in a set of parentheses. The first Runas_List indicates which users the command may be run as via ssuuddoo's --uu option. The second defines a list of groups that - can be specified via ssuuddoo's --gg option. If both Runas_Lists are - specified, the command may be run with any combination of users and - groups listed in their respective Runas_Lists. If only the first is - specified, the command may be run as any user in the list but no --gg - option may be specified. If the first Runas_List is empty but the second - is specified, the command may be run as the invoking user with the group - set to any listed in the Runas_List. If both Runas_Lists are empty, the - command may only be run as the invoking user. If no Runas_Spec is - specified the command may be run as rroooott and no group may be specified. + can be specified via ssuuddoo's --gg option in addition to any of the target + user's groups. If both Runas_Lists are specified, the command may be run + with any combination of users and groups listed in their respective + Runas_Lists. If only the first is specified, the command may be run as + any user in the list but no --gg option may be specified. If the first + Runas_List is empty but the second is specified, the command may be run + as the invoking user with the group set to any listed in the Runas_List. + If both Runas_Lists are empty, the command may only be run as the + invoking user. If no Runas_Spec is specified the command may be run as + rroooott and no group may be specified. A Runas_Spec sets the default for the commands that follow it. What this means is that for the entry: @@ -2927,4 +2928,4 @@ DDIISSCCLLAAIIMMEERR file distributed with ssuuddoo or https://www.sudo.ws/license.html for complete details. -Sudo 1.8.26 October 7, 2018 Sudo 1.8.26 +Sudo 1.8.26 October 27, 2018 Sudo 1.8.26 diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in index 642f2fce9..cfa420171 100644 --- a/doc/sudoers.man.in +++ b/doc/sudoers.man.in @@ -19,7 +19,7 @@ .\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" -.TH "SUDOERS" "5" "October 7, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual" +.TH "SUDOERS" "5" "October 27, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .nh .if n .ad l .SH "NAME" @@ -1092,7 +1092,7 @@ option. The second defines a list of groups that can be specified via \fBsudo\fR's \fB\-g\fR -option. +option in addition to any of the target user's groups. If both \fRRunas_List\fRs are specified, the command may be run with any combination of users diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in index c592edee7..9414c68cb 100644 --- a/doc/sudoers.mdoc.in +++ b/doc/sudoers.mdoc.in @@ -18,7 +18,7 @@ .\" Agency (DARPA) and Air Force Research Laboratory, Air Force .\" Materiel Command, USAF, under agreement number F39502-99-1-0512. .\" -.Dd October 7, 2018 +.Dd October 27, 2018 .Dt SUDOERS @mansectform@ .Os Sudo @PACKAGE_VERSION@ .Sh NAME @@ -1045,7 +1045,7 @@ option. The second defines a list of groups that can be specified via .Nm sudo Ns 's .Fl g -option. +option in addition to any of the target user's groups. If both .Li Runas_List Ns s are specified, the command may be run with any combination of users -- 2.40.0