info > sudoers(5)

man perldoc info pydoc3 ri search

Not found locally for sudoers. Try Google search

📄 NAME

sudoers — default sudo security policy plugin

🚀 Quick Reference

Use Case	Command	Description
Allow user to run any command	username ALL=(ALL:ALL) ALL	Grant full sudo access to a user
Allow group to run specific commands	%group ALL=/usr/bin/apt,/usr/bin/systemctl	Restrict a group to only certain commands
Run command as another user	sudo -u operator /bin/ls	Execute command as a different user
Edit files securely with sudoedit	sudoedit /etc/fstab	Edit files with your own editor, root-owned copy
Run command without password	username ALL=(ALL) NOPASSWD:ALL	Skip password prompt for specified commands
Set environment variable preservation	Defaults env_keep+="DISPLAY HOME"	Keep specific environment variables for commands
Log all commands	Defaults log_input,log_output	Enable I/O logging for all sudo commands
Use LDAP for sudoers	sudoers: files ldap in nsswitch.conf	Store sudo rules in LDAP directory

📝 DESCRIPTION

The sudoers policy plugin determines a user's sudo privileges. It is the default sudo policy plugin. The policy is driven by the /etc/sudoers file or, optionally, in LDAP. The policy format is described in detail in the SUDOERS FILE FORMAT section. For information on storing sudoers policy information in LDAP, please see sudoers.ldap(5).

🔧 Configuring sudo.conf for sudoers

sudo consults the sudo.conf(5) file to determine which plugins to load. If no sudo.conf(5) file is present, or if it contains no Plugin lines, sudoers will be used for auditing, policy decisions and I/O logging. To explicitly configure sudo.conf(5) to use the sudoers plugin, the following configuration can be used.

Plugin sudoers_audit sudoers.so
Plugin sudoers_policy sudoers.so
Plugin sudoers_io sudoers.so

Starting with sudo 1.8.5, it is possible to specify optional arguments to the sudoers plugin in the sudo.conf(5) file. The following plugin arguments are supported:

• error_recovery=bool — Attempt to recover from syntax errors in the sudoers file.
• ldap_conf=pathname — Override default path to ldap.conf.
• ldap_secret=pathname — Override default path to ldap.secret.
• sudoers_file=pathname — Override default path to sudoers file.
• sudoers_uid=user-ID — Override default owner of sudoers file.
• sudoers_gid=group-ID — Override default group of sudoers file.
• sudoers_mode=mode — Override default file mode for sudoers file.

🔐 User Authentication

The sudoers security policy requires that most users authenticate themselves before they can use sudo. A password is not required if the invoking user is root, if the target user is the same as the invoking user, or if the policy has disabled authentication. Unlike su(1), when sudoers requires authentication, it validates the invoking user's credentials, not the target user's (or root's) credentials. This can be changed via the rootpw, targetpw and runaspw flags.

If a user who is not listed in the policy tries to run a command via sudo, mail is sent to the proper authorities. The address used for such mail is configurable via the mailto Defaults entry and defaults to root.

sudoers uses per-user time stamp files for credential caching. Once a user has been authenticated, a record is written containing the user-ID used, the terminal session ID, the start time of the session leader, and a time stamp (using a monotonic clock if available). The user may then use sudo without a password for a short period of time (15 minutes unless overridden by timestamp_timeout).

📋 Logging

By default, sudoers logs both successful and unsuccessful attempts (as well as errors). The log_allowed and log_denied flags can be used to control this behavior. Messages can be logged to syslog(3), a log file, or both. The default is to log to syslog(3) but this is configurable via the syslog and logfile settings.

sudoers is also capable of running a command in a pseudo-terminal and logging all input and/or output. I/O logging can be enabled using the log_input and log_output options as well as the LOG_INPUT and LOG_OUTPUT command tags.

Starting with version 1.9, the log_servers setting may be used to send event and I/O log data to a remote server running sudo_logsrvd.

🌐 Command environment

Since environment variables can influence program behavior, sudoers provides a means to restrict which variables from the user's environment are inherited by the command to be run. By default, the env_reset flag is enabled, causing commands to be executed with a new, minimal environment. The env_check, env_keep, and env_delete options allow fine-grained control.

Environment variables with a value beginning with () are removed unless both the name and value parts are matched by env_keep or env_check, as they may be interpreted as functions by the bash shell.

Other sudoers options may influence the command environment, such as always_set_home, secure_path, set_logname, and set_home.

If the -i option is specified, sudoers will initialize the environment regardless of the value of env_reset.

📄 SUDOERS FILE FORMAT

The sudoers file is composed of two types of entries: aliases (basically variables) and user specifications (which specify who may run what). When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used.

📊 Resource limits

By default, sudoers uses the operating system's native method of setting resource limits for the target user. Resource limits may also be set in the sudoers file itself, in which case they override those set by the system. Resource limits can be specified in one of the following formats:

• "value" — Both soft and hard limits set to the same value.
• "soft,hard" — Two comma-separated values.
• "default" — Use the default resource limit for the user.
• "user" — Preserve the invoking user's resource limits.

For example: Defaults rlimit_core=default

📖 Quick guide to EBNF

EBNF is a concise way of describing the grammar of a language. Symbols and operators:

• ? — Optional (zero or one)
• * — Zero or more
• + — One or more
• Parentheses group symbols.
• Single quotes '' denote verbatim character strings.

🏷️ Aliases

There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias and Cmnd_Alias. (Beginning with sudo 1.9.0, Cmd_Alias may be used in place of Cmnd_Alias.)

Each alias definition is of the form:

Alias_Type NAME = item1, item2, ...

Where NAME is a string of uppercase letters, numbers, and underscores, starting with an uppercase letter.

⚙️ Defaults

Certain configuration options may be changed from their default values at run-time via one or more Default_Entry lines. These may affect all users on any host, all users on a specific host, a specific user, a specific command, or commands being run as a specific user. Parameters may be flags, integer values, strings, or lists.

Operators: = (set), += (add to list), -= (remove from list), ! (negate).

👤 User specification

The basic structure of a user specification is:

who where = (as_whom) what

Components: Runas_Spec (determines user and/or group), Option_Spec (SELinux, dates, timeouts, chdir, chroot), Tag_Spec (EXEC, NOEXEC, LOG_INPUT, etc.).

Tags include: EXEC, NOEXEC, FOLLOW, NOFOLLOW, LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT, NOLOG_OUTPUT, MAIL, NOMAIL, PASSWD, NOPASSWD, SETENV, NOSETENV, INTERCEPT, NOINTERCEPT.

Wildcards: * (any characters), ? (single character), [...] (range), [!...] (not in range), \x (escape).

Including other files: @include and @includedir directives. #include and #includedir are also accepted for compatibility.

Reserved words: ALL, CHROOT, ROLE, TYPE, TIMEOUT, CWD, NOTBEFORE, NOTAFTER. The ! operator can be used for negation.

⚙️ SUDOERS OPTIONS

sudo's behavior can be modified by Default_Entry lines. Supported options are grouped by type:

🔲 Boolean Flags

• always_query_group_plugin — Use group plugin to resolve %group if no system group exists.
• always_set_home — Set HOME to target user's home directory.
• authenticate — Require authentication before running commands.
• case_insensitive_group — Match group names case-insensitively.
• case_insensitive_user — Match user names case-insensitively.
• closefrom_override — Allow user to use -C option.
• compress_io — Compress I/O logs with zlib.
• exec_background — Run command in background in pseudo-terminal.
• env_editor — visudo uses SUDO_EDITOR/VISUAL/EDITOR.
• env_reset — Run command in minimal environment.
• fast_glob — Use fnmatch() instead of glob() for path matching.
• fqdn — Use fully qualified host names in sudoers.
• ignore_audit_errors — Allow command even if audit log fails.
• ignore_dot — Ignore "." in PATH.
• ignore_iolog_errors — Allow command if I/O log write fails.
• ignore_logfile_errors — Allow command if log file write fails.
• ignore_local_sudoers — Skip parsing /etc/sudoers.
• ignore_unknown_defaults — Suppress warnings for unknown defaults.
• insults — Insult user on incorrect password.
• log_allowed — Log allowed commands.
• log_denied — Log denied commands.
• log_exit_status — Log exit status of commands.
• log_host — Include hostname in log file.
• log_input — Log all user input.
• log_output — Log all output.
• log_server_keepalive — Enable TCP keepalive on log server connection.
• log_server_verify — Verify server certificate over TLS.
• log_subcmds — Log when command spawns child processes.
• log_year — Include year in log file entries.
• long_otp_prompt — Use two-line OTP prompt.
• mail_all_cmnds — Send mail on every sudo attempt.
• mail_always — Send mail on every sudo run.
• mail_badpass — Send mail on incorrect password.
• mail_no_host — Send mail if user not allowed on host.
• mail_no_perms — Send mail if command not allowed.
• mail_no_user — Send mail if user not in sudoers.
• match_group_by_gid — Match groups by group-ID instead of name.
• intercept — Enable intercept mode for all commands.
• intercept_allow_setid — Allow set-user-ID/set-group-ID programs in intercept mode.
• intercept_authenticate — Require authentication for intercepted commands when timestamp expired.
• netgroup_tuple — Use full netgroup tuple (host, user, domain).
• noexec — Enable noexec for all commands.
• pam_acct_mgmt — Perform PAM account validation.
• pam_rhost — Set PAM remote host value.
• pam_ruser — Set PAM remote user value.
• pam_session — Create new PAM session for command.
• pam_setcred — Establish credentials for target user.
• passprompt_override — Always use passprompt even if PAM provides prompt.
• path_info — Tell user when command not found in PATH.
• preserve_groups — Leave user's group vector unchanged.
• pwfeedback — Show visual feedback when entering password.
• requiretty — Require real tty for sudo.
• root_sudo — Allow root to run sudo.
• rootpw — Prompt for root password instead of invoking user's.
• runas_allow_unknown_id — Allow matching of unknown user/group IDs.
• runas_check_shell — Only run commands as users with valid shell.
• runaspw — Prompt for password of runas_default user.
• selinux — Allow SELinux role/type specification.
• set_home — Set HOME when -s option used.
• set_logname — Set LOGNAME and USER to target user.
• set_utmp — Create utmp entry when pseudo-terminal allocated.
• setenv — Allow user to disable env_reset with -E.
• shell_noargs — Run shell if sudo invoked with no arguments.
• stay_setuid — Leave real user-ID as invoking user.
• sudoedit_checkdir — Check writability of directory components.
• sudoedit_follow — Allow sudoedit to follow symbolic links.
• syslog_pid — Include PID in syslog entries.
• targetpw — Prompt for password of target user.
• tty_tickets — (Superseded by timestamp_type).
• umask_override — Set umask as specified in sudoers without modification.
• use_netgroups — Allow netgroups in sudoers.
• use_pty — Run command in pseudo-terminal even without I/O logging.
• user_command_timeouts — Allow user to specify timeout on command line.
• utmp_runas — Store runas user in utmp entry.
• visiblepw — Prompt for password even when echo is visible.

🔢 Integers

• closefrom — File descriptor to start closing from (default 3).
• command_timeout — Maximum time a command is allowed to run.
• log_server_timeout — Maximum time to wait for log server (default 30s).
• maxseq — Maximum sequence number for I/O log files (default 2176782336).
• passwd_tries — Number of password attempts before failure (default 3).
• syslog_maxlen — Maximum syslog message length (default 980).

🔢 Integers that can be used in a boolean context

• loglinelen — Characters per line for file log (default 80).
• passwd_timeout — Minutes before password prompt times out (default 0).
• timestamp_timeout — Minutes before sudo asks for password again (default 15).
• umask — File mode creation mask (default 0022).

🔤 Strings

• authfail_message — Message after failed authentication.
• badpass_message — Message on incorrect password.
• editor — Colon-separated list of editors for sudoedit/visudo.
• iolog_dir — Top-level directory for I/O logs (default /var/log/sudo-io).
• iolog_file — Relative path for I/O logs (default "%{seq}").
• iolog_flush — Flush I/O log data to disk after each write.
• iolog_group — Group for I/O log files.
• iolog_mode — File mode for I/O log files (default 0600).
• iolog_user — User for I/O log files.
• lecture_status_dir — Directory for lecture status files (default /var/lib/sudo/lectured).
• log_server_cabundle — Path to CA bundle for TLS log server.
• log_server_peer_cert — Path to client certificate for TLS.
• log_server_peer_key — Path to client private key for TLS.
• mailsub — Subject of mail sent to mailto user.
• pam_askpass_service — PAM service name when -A option used.
• pam_login_service — PAM service name when -i option used.
• pam_service — PAM service name (default "sudo").
• passprompt — Password prompt (default "[sudo] password for %p: ").
• role — Default SELinux role.
• runas_default — Default user to run commands as (default root).
• sudoers_locale — Locale for parsing sudoers (default "C").
• timestamp_type — Type of time stamp record (global, ppid, tty, kernel).
• timestampdir — Directory for time stamp files (default /run/sudo/ts).
• timestampowner — Owner of time stamp directory (default root).
• type — Default SELinux type.

🔤 Strings that can be used in a boolean context

• admin_flag — Path to file created when admin user runs sudo.
• env_file — Path to file with environment variables to set.
• exempt_group — Group exempt from password and PATH requirements.
• fdexec — Determines whether to execute by file descriptor (always, never, digest_only).
• group_plugin — Path to group provider plugin with optional arguments.
• lecture — When to display lecture (always, never, once).
• lecture_file — Path to alternate lecture file.
• listpw — When password required for -l option (all, always, any, never).
• log_format — Event log format (json, sudo).
• logfile — Path to log file (default syslog only).
• mailerflags — Flags for mailer (default -t).
• mailerpath — Path to mail program.
• mailfrom — Address for "from" field in mail.
• mailto — Address to send warning mail to (default root).
• rlimit_as — Maximum address space size.
• rlimit_core — Maximum core dump size (default 0).
• rlimit_cpu — Maximum CPU time.
• rlimit_data — Maximum data segment size.
• rlimit_fsize — Maximum file size.
• rlimit_locks — Maximum number of locks.
• rlimit_memlock — Maximum memory that can be locked.
• rlimit_nofile — Maximum number of open files.
• rlimit_nproc — Maximum number of processes.
• rlimit_rss — Maximum resident set size.
• rlimit_stack — Maximum stack size.
• restricted_env_file — Path to file with restricted environment variables.
• runchroot — Default root directory for command.
• runcwd — Default working directory for command.
• secure_path — Path to use instead of user's PATH.
• syslog — Syslog facility (default authpriv).
• syslog_badpri — Syslog priority for denied commands (default alert).
• syslog_goodpri — Syslog priority for allowed commands (default notice).
• verifypw — When password required for -v option (all, always, any, never).

📋 Lists that can be used in a boolean context

• env_check — Environment variables to check for safety.
• env_delete — Environment variables to remove when env_reset off.
• env_keep — Environment variables to preserve when env_reset on.
• log_servers — List of remote log servers (host[:port][(tls)]).

🔌 GROUP PROVIDER PLUGINS

The sudoers plugin supports its own plugin interface to allow non-Unix group lookups. Group provider plugins are specified via the group_plugin setting. The following plugins are installed by default:

• group_file — Supports an alternate group file similar to /etc/group.
• system_group — Uses standard C library functions for group lookups.

📝 LOG FORMAT

sudoers can log events in either JSON or sudo format. The sudo log format for accepted commands is:

date hostname progname: username : TTY=ttyname ; CHROOT=chroot ; \
    PWD=cwd ; USER=runasuser ; GROUP=runasgroup ; TSID=logid ; \
    ENV=env_vars COMMAND=command

For denied commands, reasons include "user NOT in sudoers", "command not allowed", "3 incorrect password attempts", etc.

📁 I/O LOG FILES

When I/O logging is enabled, sudo runs the command in a pseudo-terminal and logs input/output to the directory specified by iolog_dir (default /var/log/sudo-io). Each log directory contains:

• log — Text file with command information.
• log.json — JSON-formatted command information.
• timing — Timing information for replay.
• ttyin — Raw input from user's terminal.
• stdin — Standard input when no terminal.
• ttyout — Output from pseudo-terminal.
• stdout — Standard output when no terminal.
• stderr — Standard error redirected to pipe/file.

📂 FILES

• /etc/sudo.conf — Sudo front-end configuration
• /etc/sudoers — List of who can run what
• /etc/group — Local groups file
• /etc/netgroup — List of network groups
• /var/log/sudo-io — I/O log files
• /run/sudo/ts — Directory containing time stamps
• /var/lib/sudo/lectured — Lecture status files
• /etc/environment — Initial environment for -i mode on AIX and Linux

🔧 EXAMPLES

Below are example sudoers file entries:

# Run X applications through sudo; HOME is used to find the
# .Xauthority file.  Note that other programs use HOME to find
# configuration files and this may lead to privilege escalation!
Defaults env_keep += "DISPLAY HOME"

# User alias specification
User_Alias      FULLTIMERS = millert, mikef, dowdy
User_Alias      PARTTIMERS = bostley, jwfox, crawl
User_Alias      WEBADMIN = will, wendy, wim

# Runas alias specification
Runas_Alias     OP = root, operator
Runas_Alias     DB = oracle, sybase
Runas_Alias     ADMINGRP = adm, oper

# Host alias specification
Host_Alias      SPARC = bigtime, eclipse, moet, anchor
Host_Alias      SGI = grolsch, dandelion, black
Host_Alias      ALPHA = widget, thalamus, foobar
Host_Alias      HPPA = boa, nag, python
Host_Alias      CUNETS = 128.138.0.0/255.255.0.0
Host_Alias      CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias      SERVERS = primary, mail, www, ns
Host_Alias      CDROM = orion, perseus, hercules

# Cmnd alias specification
Cmnd_Alias      DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
                        /usr/sbin/restore, /usr/sbin/rrestore,\
                        sha224:... /home/operator/bin/start_backups
Cmnd_Alias      KILL = /usr/bin/kill
Cmnd_Alias      PRINTING = /usr/sbin/lpc, /usr/bin/lprm
Cmnd_Alias      SHUTDOWN = /usr/sbin/shutdown
Cmnd_Alias      HALT = /usr/sbin/halt
Cmnd_Alias      REBOOT = /usr/sbin/reboot
Cmnd_Alias      SHELLS = /usr/bin/sh, /usr/bin/csh, /usr/bin/ksh,\
                         /usr/local/bin/tcsh, /usr/bin/rsh,\
                         /usr/local/bin/zsh
Cmnd_Alias      SU = /usr/bin/su
Cmnd_Alias      PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less

# Override built-in defaults
Defaults                syslog=auth,runcwd=~
Defaults>root           !set_logname
Defaults:FULLTIMERS     !lecture,runchroot=*
Defaults:millert        !authenticate
Defaults@SERVERS        log_year, logfile=/var/log/sudo.log
Defaults!PAGERS         noexec

# User specifications
root            ALL = (ALL) ALL
%wheel          ALL = (ALL) ALL
FULLTIMERS      ALL = NOPASSWD: ALL
PARTTIMERS      ALL = ALL
jack            CSNETS = ALL
lisa            CUNETS = ALL
operator        ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
                     sudoedit /etc/printcap, /usr/oper/bin/
joe             ALL = /usr/bin/su operator
pete            HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd *root*
%opers          ALL = (: ADMINGRP) /usr/sbin/
bob             SPARC = (OP) ALL : SGI = (OP) ALL
jim             +biglab = ALL
+secretaries    ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
fred            ALL = (DB) NOPASSWD: ALL
john            ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
jen             ALL, !SERVERS = ALL
jill            SERVERS = /usr/bin/, !SU, !SHELLS
steve           CSNETS = (operator) /usr/local/op_commands/
matt            valkyrie = KILL
WEBADMIN        www = (www) ALL, (root) /usr/bin/su www
ALL             CDROM = NOPASSWD: /sbin/umount /CDROM,\
                /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM

🛡️ SECURITY NOTES

⚠️ Limitations of the '!' operator

It is generally not effective to "subtract" commands from ALL using the '!' operator. A user can trivially circumvent this by copying the desired command to a different name. Therefore, these kind of restrictions should be considered advisory at best.

📁 Security implications of fast_glob

If fast_glob is in use, it is not possible to reliably negate commands where the path name includes globbing characters, as fnmatch() cannot resolve relative paths.

🔒 Preventing shell escapes

Four approaches: restrict (avoid giving access to commands that allow shell escapes), intercept (use LD_PRELOAD to intercept exec calls), log (log commands via log_output or log_subcmds), noexec (prevent command from executing other programs).

✏️ Secure editing

sudoedit allows users to securely edit files with their own editor. The editor runs with the invoking user's permissions on a temporary copy. Users should never be granted sudoedit permission to edit a file in a directory they have write access to.

⏰ Time stamp file checks

sudoers checks ownership and permissions of its time stamp directory. It ignores time stamps set far in the future. On systems with monotonic clock, it uses that to prevent time stamp manipulation.

🐛 DEBUGGING

Versions 1.8.4 and higher support a flexible debugging framework. Configure in sudo.conf with format:

Debug sudoers.so /var/log/sudoers_debug match@info,nss@info

Priorities: crit, err, warn, notice, diag, info, trace, debug. Subsystems: alias, all, audit, auth, defaults, env, ldap, logging, match, netif, nss, parser, perms, plugin, pty, rbtree, sssd, util.

📚 SEE ALSO

ssh(1), su(1), fnmatch(3), glob(3), mktemp(3), strftime(3), sudo.conf(5), sudo_plugin(5), sudoers.ldap(5), sudoers_timestamp(5), sudo(8), visudo(8)

👤 AUTHORS

Many people have worked on sudo over the years; this version consists of code written primarily by Todd C. Miller. See the CONTRIBUTORS file in the sudo distribution (https://www.sudo.ws/contributors.html).

⚠️ CAVEATS

The sudoers file should always be edited by visudo which locks the file and checks for syntax errors. If sudoers contains syntax errors, sudo may refuse to run. When using netgroups of machines, you need to have the machine's host name fully qualified or use the fqdn option.

🐞 BUGS

Submit bug reports at https://bugzilla.sudo.ws/

🙋 SUPPORT

Limited free support via the sudo-users mailing list: https://www.sudo.ws/mailman/listinfo/sudo-users

⚖️ DISCLAIMER

sudo is provided "AS IS" and any express or implied warranties are disclaimed. See the LICENSE file distributed with sudo or https://www.sudo.ws/license.html for complete details.

📄 NAME 🚀 Quick Reference 📝 DESCRIPTION 📄 SUDOERS FILE FORMAT ⚙️ SUDOERS OPTIONS 🔌 GROUP PROVIDER PLUGINS 📝 LOG FORMAT 📁 I/O LOG FILES 📂 FILES 🔧 EXAMPLES 🛡️ SECURITY NOTES 🐛 DEBUGGING 📚 SEE ALSO 👤 AUTHORS ⚠️ CAVEATS 🐞 BUGS 🙋 SUPPORT ⚖️ DISCLAIMER