{
    "mode": "info",
    "parameter": "SUDOERS_TIMESTAMP",
    "section": "",
    "url": "https://www.chedong.com/phpMan.php/info/SUDOERS_TIMESTAMP/json",
    "generated": "2026-07-05T16:06:46Z",
    "sections": {
        "NAME": {
            "content": "sudoerstimestamp -- Sudoers Time Stamp Format\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The sudoers plugin uses per-user time stamp files for credential caching.\nOnce a user has been authenticated, they may use sudo without a password\nfor a short period of time (15 minutes unless overridden by the\ntimestamptimeout option).  By default, sudoers uses a separate record\nfor each terminal, which means that a user's login sessions are authenti-\ncated separately.  The timestamptype option can be used to select the\ntype of time stamp record sudoers will use.\n\nA multi-record time stamp file format was introduced in sudo 1.8.10 that\nuses a single file per user.  Previously, a separate file was used for\neach user and terminal combination unless tty-based time stamps were dis-\nabled.  The new format is extensible and records of multiple types and\nversions may coexist within the same file.\n\nAll records, regardless of type or version, begin with a 16-bit version\nnumber and a 16-bit record size.\n\nTime stamp records have the following structure:\n\n/* Time stamp entry types */\n#define TSGLOBAL               0x01    /* not restricted by tty or ppid */\n#define TSTTY                  0x02    /* restricted by tty */\n#define TSPPID                 0x03    /* restricted by ppid */\n#define TSLOCKEXCL             0x04    /* special lock record */\n\n/* Time stamp flags */\n#define TSDISABLED             0x01    /* entry disabled */\n#define TSANYUID               0x02    /* ignore uid, only valid in key */\n\nstruct timestampentry {\nunsigned short version;     /* version number */\nunsigned short size;        /* entry size */\nunsigned short type;        /* TSGLOBAL, TSTTY, TSPPID */\nunsigned short flags;       /* TSDISABLED, TSANYUID */\nuidt authuid;             /* uid to authenticate as */\npidt sid;                  /* session ID associated with tty/ppid */\nstruct timespec starttime; /* session/ppid start time */\nstruct timespec ts;         /* time stamp (CLOCKMONOTONIC) */\nunion {\ndevt ttydev;           /* tty device number */\npidt ppid;             /* parent pid */\n} u;\n};\n\nThe timestampentry struct fields are as follows:\n\nversion\nThe version number of the timestampentry struct.  New entries are\ncreated with a version number of 2.  Records with different version\nnumbers may coexist in the same file but are not inter-operable.\n\nsize  The size of the record in bytes.\n\ntype  The record type, currently TSGLOBAL, TSTTY, or TSPPID.\n\nflags\nZero or more record flags which can be bit-wise ORed together.\nSupported flags are TSDISABLED, for records disabled via sudo -k\nand TSANYUID, which is used only when matching records.\n\nauthuid\nThe user-ID that was used for authentication.  Depending on the\nvalue of the rootpw, runaspw and targetpw options, the user-ID may\nbe that of the invoking user, the root user, the default runas user\nor the target user.\n\nsid   The ID of the user's terminal session, if present.  The session ID\nis only used when matching records of type TSTTY.\n\nstarttime\nThe start time of the session leader for records of type TSTTY or\nof the parent process for records of type TSPPID.  The starttime\nis used to help prevent re-use of a time stamp record after a user\nhas logged out.  Not all systems support a method to easily re-\ntrieve a process's start time.  The starttime field was added in\nsudoers version 1.8.22 for the second revision of the timestampen-\ntry struct.\n\nts    The actual time stamp.  A monotonic time source (which does not\nmove backward) is used if the system supports it.  Where possible,\nsudoers uses a monotonic timer that increments even while the sys-\ntem is suspended.  The value of ts is updated each time a command\nis run via sudo.  If the difference between ts and the current time\nis less than the value of the timestamptimeout option, no password\nis required.\n\nu.ttydev\nThe device number of the terminal associated with the session for\nrecords of type TSTTY.\n\nu.ppid\nThe ID of the parent process for records of type TSPPID.\n",
            "subsections": []
        },
        "LOCKING": {
            "content": "In sudoers versions 1.8.10 through 1.8.14, the entire time stamp file was\nlocked for exclusive access when reading or writing to the file.  Start-\ning in sudoers 1.8.15, individual records are locked in the time stamp\nfile instead of the entire file and the lock is held for a longer period\nof time.  This scheme is described below.\n\nThe first record in the time stamp file is of type TSLOCKEXCL and is\nused as a lock record to prevent more than one sudo process from adding a\nnew record at the same time.  Once the desired time stamp record has been\nlocated or created (and locked), the TSLOCKEXCL record is unlocked.  The\nlock on the individual time stamp record, however, is held until authen-\ntication is complete.  This allows sudoers to avoid prompting for a pass-\nword multiple times when it is used more than once in a pipeline.\n\nRecords of type TSGLOBAL cannot be locked for a long period of time\nsince doing so would interfere with other sudo processes.  Instead, a\nseparate lock record is used to prevent multiple sudo processes using the\nsame terminal (or parent process ID) from prompting for a password as the\nsame time.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "sudoers(5), sudo(8)\n",
            "subsections": []
        },
        "HISTORY": {
            "content": "Originally, sudo used a single zero-length file per user and the file's\nmodification time was used as the time stamp.  Later versions of sudo\nadded restrictions on the ownership of the time stamp files and directory\nas well as checks on the validity of the time stamp itself.  Notable\nchanges were introduced in the following sudo versions:\n\n1.4.0\nSupport for tty-based time stamp file was added by appending the\nterminal name to the time stamp file name.\n\n1.6.2\nThe time stamp file was replaced by a per-user directory which con-\ntained any tty-based time stamp files.\n\n1.6.3p2\nThe target user name was added to the time stamp file name when the\ntargetpw option was set.\n\n1.7.3\nInformation about the terminal device was stored in tty-based time\nstamp files for validity checks.  This included the terminal device\nnumbers, inode number and, on systems where it was not updated when\nthe device was written to, the inode change time.  This helped pre-\nvent re-use of the time stamp file after logout.\n\n1.8.6p7\nThe terminal session ID was added to tty-based time stamp files to\nprevent re-use of the time stamp by the same user in a different\nterminal session.  It also helped prevent re-use of the time stamp\nfile on systems where the terminal device's inode change time was\nupdated by writing.\n\n1.8.10\nA new, multi-record time stamp file format was introduced that uses\na single file per user.  The terminal device's change time was not\nincluded since most systems now update the change time after a\nwrite is performed as required by POSIX.\n\n1.8.15\nIndividual records are locked in the time stamp file instead of the\nentire file and the lock is held until authentication is complete.\n\n1.8.22\nThe start time of the terminal session leader or parent process is\nnow stored in non-global time stamp records.  This prevents re-use\nof the time stamp file after logout in most cases.\n\nSupport was added for the kernel-based tty time stamps available in\nOpenBSD which do not use an on-disk time stamp file.\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "Many people have worked on sudo over the years; this version consists of\ncode written primarily by:\n\nTodd C. Miller\n\nSee the CONTRIBUTORS file in the sudo distribution\n(https://www.sudo.ws/contributors.html) for an exhaustive list of people\nwho have contributed to sudo.\n",
            "subsections": []
        },
        "BUGS": {
            "content": "If you feel you have found a bug in sudo, please submit a bug report at\nhttps://bugzilla.sudo.ws/\n",
            "subsections": []
        },
        "SUPPORT": {
            "content": "Limited free support is available via the sudo-users mailing list, see\nhttps://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search\nthe archives.\n",
            "subsections": []
        },
        "DISCLAIMER": {
            "content": "sudo is provided \"AS IS\" and any express or implied warranties, includ-\ning, but not limited to, the implied warranties of merchantability and\nfitness for a particular purpose are disclaimed.  See the LICENSE file\ndistributed with sudo or https://www.sudo.ws/license.html for complete\ndetails.\n",
            "subsections": []
        },
        "Sudo 1.9.9                     October 20, 2019                     Sudo 1.9.9": {
            "content": "",
            "subsections": []
        }
    },
    "summary": "sudoerstimestamp -- Sudoers Time Stamp Format",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "sudoers",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/sudoers/5/json"
        },
        {
            "name": "sudo",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/sudo/8/json"
        }
    ]
}