{
    "mode": "man",
    "parameter": "sudo.conf",
    "section": "5",
    "url": "https://www.chedong.com/phpMan.php/man/sudo.conf/5/json",
    "generated": "2026-08-07T19:51:00Z",
    "sections": {
        "NAME": {
            "content": "sudo.conf — configuration for sudo front-end\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The  sudo.conf  file  is  used to configure the sudo front-end.  It is used to configure sudo\nplugins, plugin-agnostic path names, debug flags, and other settings.\n\nThe sudo.conf file supports the following directives, described in detail below.\n\nPlugin  an approval, audit, I/O logging, or security policy plugin\n\nPath    a plugin-agnostic path\n\nSet     a front-end setting, such as disablecoredump or groupsource\n\nDebug   debug flags to aid in debugging sudo, sudoreplay, visudo, and the sudoers plugin.\n\nThe pound sign (‘#’) is used to indicate a comment.  Both the comment character and any  text\nafter it, up to the end of the line, are ignored.\n\nLong  lines can be continued with a backslash (‘\\’) as the last character on the line.  Lead‐\ning white space is removed from the beginning of lines even when a continuation character  is\nused.\n\nNon-comment lines that don't begin with Plugin, Path, Debug, or Set are silently ignored.\n\nThe sudo.conf file is always parsed in the ‘C’ locale.\n",
            "subsections": [
                {
                    "name": "Plugin configuration",
                    "content": "sudo  supports  a  plugin architecture for security policies and input/output logging.  Third\nparties can develop and distribute their own policy and I/O logging  plugins  to  work  seam‐\nlessly  with  the  sudo  front-end.   Plugins are dynamically loaded based on the contents of\nsudo.conf.\n\nA Plugin line consists of the Plugin keyword, followed by the symbolname and the path to the\ndynamic shared object that contains the plugin.  The symbolname is the name  of  the  struct\napprovalplugin,  struct  auditplugin,  struct ioplugin, or struct policyplugin defined by\nthe plugin.  If a plugin implements multiple plugin types, there must be a  Plugin  line  for\neach  unique  symbol name.  The path may be fully qualified or relative.  If not fully quali‐\nfied, it is relative to the directory specified by the plugindir  Path  setting,  which  de‐\nfaults to /usr/libexec/sudo.  In other words:\n\nPlugin sudoerspolicy sudoers.so\n\nis equivalent to:\n\nPlugin sudoerspolicy /usr/libexec/sudo/sudoers.so\n\nIf  the  plugin  was compiled statically into the sudo binary instead of being installed as a\ndynamic shared object, the path should be specified without a leading directory, as  it  does\nnot actually exist in the file system.  For example:\n\nPlugin sudoerspolicy sudoers.so\n\nOn  AIX  systems, the plugin may be either a shared object ending in ‘.so’ or an archive file\ncontaining a shared object ending in ‘.a’ with the name of the shared object  in  parentheses\nat the end.\n\nStarting with sudo 1.8.5, any additional parameters after the path are passed as arguments to\nthe  plugin's  open function.  For example, to override the compile-time default sudoers file\nmode:\n\nPlugin sudoerspolicy sudoers.so sudoersmode=0440\n\nSee the sudoers(5) manual for a list of supported arguments.\n\nThe same dynamic shared object may contain multiple plugins, each  with  a  different  symbol\nname.   The file must be owned by user-ID 0 and only writable by its owner.  Because of ambi‐\nguities that arise from composite policies, only a single policy  plugin  may  be  specified.\nThis limitation does not apply to I/O plugins.\n\nIf  no  sudo.conf file is present, or if it contains no Plugin lines, the sudoers plugin will\nbe used as the default security policy, for I/O logging (if enabled by the policy),  and  for\nauditing.  This is equivalent to the following:\n\nPlugin sudoerspolicy sudoers.so\nPlugin sudoersio sudoers.so\nPlugin sudoersaudit sudoers.so\n\nStarting with sudo version 1.9.1, some of the logging functionality of the sudoers plugin has\nbeen  moved  from  the  policy  plugin  to  an  audit plugin.  To maintain compatibility with\nsudo.conf files from older sudo versions, if sudoers is configured as the security policy, it\nwill be used as an audit plugin as well.  This guarantees that the logging behavior  will  be\nconsistent with that of sudo versions 1.9.0 and below.\n\nFor more information on the sudo plugin architecture, see the sudoplugin(5) manual.\n"
                },
                {
                    "name": "Path settings",
                    "content": "A  Path  line  consists  of the Path keyword, followed by the name of the path to set and its\nvalue.  For example:\n\nPath intercept /usr/libexec/sudo/sudointercept.so\nPath noexec /usr/libexec/sudo/sudonoexec.so\nPath askpass /usr/X11R6/bin/ssh-askpass\n\nIf no path name is specified, features relying on the specified  setting  will  be  disabled.\nDisabling Path settings is only supported in sudo version 1.8.16 and higher.\n\nThe following plugin-agnostic paths may be set in the /etc/sudo.conf file:\n\naskpass\nThe  fully  qualified path to a helper program used to read the user's password when no\nterminal is available.  This may be the case when sudo is executed from a graphical (as\nopposed to text-based) application.  The program specified by  askpass  should  display\nthe  argument  passed to it as the prompt and write the user's password to the standard\noutput.  The value of askpass may be overridden by the SUDOASKPASS  environment  vari‐\nable.\n\ndevsearch\nAn  ordered,  colon-separated  search  path of directories to look in for device nodes.\nThis is used when mapping the process's tty device number to a device name  on  systems\nthat  do not provide such a mechanism.  Sudo will not recurse into sub-directories.  If\nterminal devices may be located in a sub-directory of /dev, that path must  be  explic‐\nitly       listed       in       devsearch.        The       default      value      is\n/dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev\n\nThis option is ignored on systems that support either the devname()  or  ttynamedev()\nfunctions, for example BSD, macOS and Solaris.\n\nintercept\nThe  path  to  a  shared  library  containing  a  wrappers for the execve(2), execl(3),\nexecle(3), execlp(3), execv(3), execvp(3), execvpe(3), and system(3) library  functions\nthat intercepts attempts to run further commands and performs a policy check before al‐\nlowing  them  to  be executed.  This is used to implement the intercept and logsubcmds\nfunctionality on systems that support LDPRELOAD or the equivalent.\n\nThe intercept path may be set to either a single fully-qualified path, or, for  systems\nthat  support  separate LDPRELOAD environment variables for 32-bit and 64-bit executa‐\nbles, it may optionally be set to two fully-qualified paths separated by a colon (‘:’).\nThe first path should be the 32-bit version and the second the  64-bit  version.   This\ntwo-path  form  is  currently  only  supported on AIX and Solaris systems.  The default\nvalue is /usr/libexec/sudo/sudointercept.so.\n\nnoexec\nThe path  to  a  shared  library  containing  wrappers  for  the  execve(2),  execl(3),\nexecle(3),   execlp(3),   exect(3),   execv(3),   execveat(3),   execvP(3),  execvp(3),\nexecvpe(3),  fexecve(3),  popen(3),  posixspawn(3),  posixspawnp(3),  system(3),  and\nwordexp(3)  library  functions that prevent the execution of further commands.  This is\nused to implement the noexec functionality on systems that support  LDPRELOAD  or  the\nequivalent.\n\nThe  noexec  path  may  be set to either a single fully-qualified path, or, for systems\nthat support separate LDPRELOAD environment variables for 32-bit and  64-bit  executa‐\nbles, it may optionally be set to two fully-qualified paths separated by a colon (‘:’).\nThe  first  path  should be the 32-bit version and the second the 64-bit version.  This\ntwo-path form is currently only supported on AIX  and  Solaris  systems.   The  default\nvalue is /usr/libexec/sudo/sudonoexec.so.\n\nplugindir\nThe  default  directory  to use when searching for plugins that are specified without a\nfully qualified path name.  The default value is /usr/libexec/sudo.\n\nsesh  The fully-qualified path to the sesh binary.  This setting is only used  when  sudo  is\nbuilt with SELinux support.  The default value is /usr/libexec/sudo/sesh.\n"
                },
                {
                    "name": "Other settings",
                    "content": "The sudo.conf file also supports the following front-end settings:\n\ndisablecoredump\nCore  dumps  of sudo itself are disabled by default to prevent the disclosure of poten‐\ntially sensitive information.  To aid in debugging sudo crashes, you may wish to re-en‐\nable core dumps by setting “disablecoredump” to false in sudo.conf as follows:\n\nSet disablecoredump false\n\nAll modern  operating  systems  place  restrictions  on  core  dumps  from  set-user-ID\nprocesses  like  sudo  so this option can be enabled without compromising security.  To\nactually get a sudo core file you will likely need to enable core dumps for set-user-ID\nprocesses.  On BSD and Linux systems this is accomplished in the sysctl(8) command.  On\nSolaris, the coreadm(1m) command is used to configure core dump behavior.\n\nThis setting is only available in sudo version 1.8.4 and higher.\n\ngroupsource\nsudo passes the invoking user's group list to the policy and I/O plugins.  On most sys‐\ntems, there is an upper limit to the number of groups that a user may belong to  simul‐\ntaneously  (typically  16  for compatibility with NFS).  On systems with the getconf(1)\nutility, running:\ngetconf NGROUPSMAX\nwill return the maximum number of groups.\n\nHowever, it is still possible to be a member of a larger number of groups--they  simply\nwon't be included in the group list returned by the kernel for the user.  Starting with\nsudo  version 1.8.7, if the user's kernel group list has the maximum number of entries,\nsudo will consult the group database directly to determine the group list.  This  makes\nit  possible  for  the  security policy to perform matching by group name even when the\nuser is a member of more than the maximum number of groups.\n\nThe groupsource setting allows the administrator  to  change  this  default  behavior.\nSupported values for groupsource are:\n\nstatic\nUse  the  static  group  list that the kernel returns.  Retrieving the group list\nthis way is very fast but it is subject to an upper limit as described above.  It\nis “static” in that it does not reflect changes to the group database made  after\nthe user logs in.  This was the default behavior prior to sudo 1.8.7.\n\ndynamic\nAlways  query  the group database directly.  It is “dynamic” in that changes made\nto the group database after the user logs in will be reflected in the group list.\nOn some systems, querying the group database for all of a user's  groups  can  be\ntime consuming when querying a network-based group database.  Most operating sys‐\ntems  provide  an  efficient  method of performing such queries.  Currently, sudo\nsupports efficient group queries on AIX, BSD, Linux, macOS, and Solaris.  This is\nthe default behavior on macOS in sudo 1.9.6 and higher.\n\nadaptive\nOnly query the group database if the static group list returned by the kernel has\nthe maximum number of entries.  This is the default  behavior  on  systems  other\nthan macOS in sudo 1.8.7 and higher.\n\nFor example, to cause sudo to only use the kernel's static list of groups for the user:\n\nSet groupsource static\n\nThis setting is only available in sudo version 1.8.7 and higher.\n\nmaxgroups\nThe  maximum  number  of  user groups to retrieve from the group database.  Values less\nthan one or larger than 1024 will be ignored.  This setting is only used when  querying\nthe group database directly.  It is intended to be used on systems where it is not pos‐\nsible  to  detect when the array to be populated with group entries is not sufficiently\nlarge.  By default, sudo will allocate four times the system's maximum number of groups\n(see above) and retry with double that number if the group database query fails.\n\nThis setting is only available in sudo version 1.8.7 and higher.  It should not be  re‐\nquired in sudo versions 1.8.24 and higher and may be removed in a later release.\n\nprobeinterfaces\nBy  default, sudo will probe the system's network interfaces and pass the IP address of\neach enabled interface to the policy plugin.  This makes it possible for the plugin  to\nmatch rules based on the IP address without having to query DNS.  On Linux systems with\na  large  number  of virtual interfaces, this may take a non-negligible amount of time.\nIf IP-based matching is not required, network interface probing can be disabled as fol‐\nlows:\n\nSet probeinterfaces false\n\nThis setting is only available in sudo version 1.8.10 and higher.\n"
                },
                {
                    "name": "Debug settings",
                    "content": "sudo versions 1.8.4 and higher support a flexible debugging framework that can log what  sudo\nis doing internally if there is a problem.\n\nA  Debug  line consists of the Debug keyword, followed by the name of the program, plugin, or\nshared object to debug, the debug file name, and a comma-separated list of debug flags.   The\ndebug  flag  syntax  used  by sudo, the sudoers plugin along with its associated programs and\nshared objects is subsystem@priority but a third-party plugin is free to use a different for‐\nmat so long as it does not include a comma (‘,’).\n\nOn AIX systems, a Debug line will  match  a  plugin  specified  as  either  the  name  of  an\nSVR4-style  shared object file ending in ‘.so’, an archive file ending in ‘.a’, or an archive\nfile ending in ‘.a’ with the name of the shared object in parentheses.\n\nExamples:\n\nDebug sudo /var/log/sudodebug all@warn,plugin@info\n\nwould log all debugging statements at the warn level and higher in addition to those  at  the\ninfo level for the plugin subsystem.\n\nDebug sudointercept.so /var/log/interceptdebug all@debug\n\nwould log all debugging statements, regardless of level, for the sudointercept.so shared li‐\nbrary that implements sudo's intercept functionality on some systems.\n\nDebug sudoers.so /var/log/sudoersdebug all@debug\n\nwould  log  all  debugging  statements,  regardless  of  level,  for the sudoers plugin.  See\nsudoers(5) for the full list of subsystems supported by the sudoers plugin.\n\nAs of sudo 1.8.12, multiple Debug entries may be specified per program.   Older  versions  of\nsudo  only  support a single Debug entry per program.  Plugin-specific Debug entries are also\nsupported starting with sudo 1.8.12 and are matched by either the base  name  of  the  plugin\nthat  was loaded (for example sudoers.so) or by the plugin's fully-qualified path name.  Pre‐\nviously, the sudoers plugin shared the same Debug entry as the sudo front-end and  could  not\nbe configured separately.\n\nThe  following  priorities  are  supported, in order of decreasing severity: crit, err, warn,\nnotice, diag, info, trace, and debug.  Each priority, when specified, also includes all  pri‐\norities  higher  than  it.   For  example,  a priority of notice would include debug messages\nlogged at notice and higher.\n\nThe priorities trace and debug also include function call tracing which logs when a  function\nis   entered   and   when   it  returns.   For  example,  the  following  trace  is  for  the\ngetusergroups() function located in src/sudo.c:\n\nsudo[123] -> getusergroups @ src/sudo.c:385\nsudo[123] <- getusergroups @ src/sudo.c:429 := groups=10,0,5\n\nWhen the function is entered, indicated by a right arrow ‘->’, the program, process ID, func‐\ntion, source file, and line number are logged.  When the function  returns,  indicated  by  a\nleft  arrow  ‘<-’, the same information is logged along with the return value.  In this case,\nthe return value is a string.\n\nThe following subsystems are used by the sudo front-end:\n\nall         matches every subsystem\n\nargs        command line argument processing\n\nconv        user conversation\n\nedit        sudoedit\n\nevent       event subsystem\n\nexec        command execution\n\nmain        sudo main function\n\nnetif       network interface handling\n\npcomm       communication with the plugin\n\nplugin      plugin configuration\n\npty         pseudo-terminal related code\n\nselinux     SELinux-specific handling\n\nutil        utility functions\n\nutmp        utmp handling\n\nThe sudoers(5) plugin includes support for additional subsystems.\n"
                }
            ]
        },
        "FILES": {
            "content": "/etc/sudo.conf            sudo front-end configuration\n",
            "subsections": []
        },
        "EXAMPLES": {
            "content": "#\n# Default /etc/sudo.conf file\n#\n# Sudo plugins:\n#   Plugin pluginname pluginpath pluginoptions ...\n#\n# The pluginpath is relative to /usr/libexec/sudo unless\n#   fully qualified.\n# The pluginname corresponds to a global symbol in the plugin\n#   that contains the plugin interface structure.\n# The pluginoptions are optional.\n#\n# The sudoers plugin is used by default if no Plugin lines are present.\n#Plugin sudoerspolicy sudoers.so\n#Plugin sudoersio sudoers.so\n#Plugin sudoersaudit sudoers.so\n\n#\n# Sudo askpass:\n#   Path askpass /path/to/askpass\n#\n# An askpass helper program may be specified to provide a graphical\n# password prompt for \"sudo -A\" support.  Sudo does not ship with its\n# own askpass program but can use the OpenSSH askpass.\n#\n# Use the OpenSSH askpass\n#Path askpass /usr/X11R6/bin/ssh-askpass\n#\n# Use the Gnome OpenSSH askpass\n#Path askpass /usr/libexec/openssh/gnome-ssh-askpass\n\n#\n# Sudo device search path:\n#   Path devsearch /dev/path1:/dev/path2:/dev\n#\n# A colon-separated list of paths to check when searching for a user's\n# terminal device.\n#\n#Path devsearch /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev\n\n#\n# Sudo command interception:\n#   Path intercept /path/to/sudointercept.so\n#\n# Path to a shared library containing replacements for the execv()\n# and execve() library functions that perform a policy check to verify\n# the command is allowed and simply return an error if not.  This is\n# used to implement the \"intercept\" functionality on systems that\n# support LDPRELOAD or its equivalent.\n#\n# The compiled-in value is usually sufficient and should only be changed\n# if you rename or move the sudointercept.so file.\n#\n#Path intercept /usr/libexec/sudo/sudointercept.so\n\n#\n# Sudo noexec:\n#   Path noexec /path/to/sudonoexec.so\n#\n# Path to a shared library containing replacements for the execv()\n# family of library functions that just return an error.  This is\n# used to implement the \"noexec\" functionality on systems that support\n# LDPRELOAD or its equivalent.\n#\n# The compiled-in value is usually sufficient and should only be changed\n# if you rename or move the sudonoexec.so file.\n#\n#Path noexec /usr/libexec/sudo/sudonoexec.so\n\n#\n# Sudo plugin directory:\n#   Path plugindir /path/to/plugins\n#\n# The default directory to use when searching for plugins that are\n# specified without a fully qualified path name.\n#\n#Path plugindir /usr/libexec/sudo\n\n#\n# Core dumps:\n#   Set disablecoredump true|false\n#\n# By default, sudo disables core dumps while it is executing (they\n# are re-enabled for the command that is run).\n# To aid in debugging sudo problems, you may wish to enable core\n# dumps by setting \"disablecoredump\" to false.\n#\n#Set disablecoredump false\n\n#\n# User groups:\n#   Set groupsource static|dynamic|adaptive\n#\n# Sudo passes the user's group list to the policy plugin.\n# If the user is a member of the maximum number of groups (usually 16),\n# sudo will query the group database directly to be sure to include\n# the full list of groups.\n#\n# On some systems, this can be expensive so the behavior is configurable.\n# The \"groupsource\" setting has three possible values:\n#   static   - use the user's list of groups returned by the kernel.\n#   dynamic  - query the group database to find the list of groups.\n#   adaptive - if user is in less than the maximum number of groups.\n#              use the kernel list, else query the group database.\n#\n#Set groupsource static\n\n#\n# Sudo interface probing:\n#   Set probeinterfaces true|false\n#\n# By default, sudo will probe the system's network interfaces and\n# pass the IP address of each enabled interface to the policy plugin.\n# On systems with a large number of virtual interfaces this may take\n# a noticeable amount of time.\n#\n#Set probeinterfaces false\n\n#\n# Sudo debug files:\n#   Debug program /path/to/debuglog subsystem@priority[,subsyste@priority]\n#\n# Sudo and related programs support logging debug information to a file.\n# The program is typically sudo, sudoers.so, sudoreplay, or visudo.\n#\n# Subsystems vary based on the program; \"all\" matches all subsystems.\n# Priority may be crit, err, warn, notice, diag, info, trace, or debug.\n# Multiple subsystem@priority may be specified, separated by a comma.\n#\n#Debug sudo /var/log/sudodebug all@debug\n#Debug sudoers.so /var/log/sudoersdebug all@debug\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "sudoplugin(5), sudoers(5), sudo(8)\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "Many people have worked on sudo over the years; this version consists of code written primar‐\nily by:\n\nTodd C. Miller\n\nSee the CONTRIBUTORS.md file in the  sudo  distribution  (https://www.sudo.ws/about/contribu‐\ntors/) for an exhaustive list of people who have contributed to sudo.\n",
            "subsections": []
        },
        "BUGS": {
            "content": "If   you   believe  you  have  found  a  bug  in  sudo,  you  can  submit  a  bug  report  at\nhttps://bugzilla.sudo.ws/\n",
            "subsections": []
        },
        "SUPPORT": {
            "content": "Limited   free   support   is   available   via   the   sudo-users    mailing    list,    see\nhttps://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the archives.\n",
            "subsections": []
        },
        "DISCLAIMER": {
            "content": "sudo  is  provided  “AS IS” and any express or implied warranties, including, but not limited\nto, the implied warranties of merchantability and fitness for a particular purpose  are  dis‐\nclaimed.  See the LICENSE.md file distributed with sudo or https://www.sudo.ws/about/license/\nfor complete details.\n\nSudo 1.9.15p5                             November 6, 2023                              SUDO.CONF(5)",
            "subsections": []
        }
    },
    "summary": "sudo.conf — configuration for sudo front-end",
    "flags": [],
    "examples": [
        "# Default /etc/sudo.conf file",
        "# Sudo plugins:",
        "#   Plugin pluginname pluginpath pluginoptions ...",
        "# The pluginpath is relative to /usr/libexec/sudo unless",
        "#   fully qualified.",
        "# The pluginname corresponds to a global symbol in the plugin",
        "#   that contains the plugin interface structure.",
        "# The pluginoptions are optional.",
        "# The sudoers plugin is used by default if no Plugin lines are present.",
        "#Plugin sudoerspolicy sudoers.so",
        "#Plugin sudoersio sudoers.so",
        "#Plugin sudoersaudit sudoers.so",
        "# Sudo askpass:",
        "#   Path askpass /path/to/askpass",
        "# An askpass helper program may be specified to provide a graphical",
        "# password prompt for \"sudo -A\" support.  Sudo does not ship with its",
        "# own askpass program but can use the OpenSSH askpass.",
        "# Use the OpenSSH askpass",
        "#Path askpass /usr/X11R6/bin/ssh-askpass",
        "# Use the Gnome OpenSSH askpass",
        "#Path askpass /usr/libexec/openssh/gnome-ssh-askpass",
        "# Sudo device search path:",
        "#   Path devsearch /dev/path1:/dev/path2:/dev",
        "# A colon-separated list of paths to check when searching for a user's",
        "# terminal device.",
        "#Path devsearch /dev/pts:/dev/vt:/dev/term:/dev/zcons:/dev/pty:/dev",
        "# Sudo command interception:",
        "#   Path intercept /path/to/sudointercept.so",
        "# Path to a shared library containing replacements for the execv()",
        "# and execve() library functions that perform a policy check to verify",
        "# the command is allowed and simply return an error if not.  This is",
        "# used to implement the \"intercept\" functionality on systems that",
        "# support LDPRELOAD or its equivalent.",
        "# The compiled-in value is usually sufficient and should only be changed",
        "# if you rename or move the sudointercept.so file.",
        "#Path intercept /usr/libexec/sudo/sudointercept.so",
        "# Sudo noexec:",
        "#   Path noexec /path/to/sudonoexec.so",
        "# Path to a shared library containing replacements for the execv()",
        "# family of library functions that just return an error.  This is",
        "# used to implement the \"noexec\" functionality on systems that support",
        "# LDPRELOAD or its equivalent.",
        "# The compiled-in value is usually sufficient and should only be changed",
        "# if you rename or move the sudonoexec.so file.",
        "#Path noexec /usr/libexec/sudo/sudonoexec.so",
        "# Sudo plugin directory:",
        "#   Path plugindir /path/to/plugins",
        "# The default directory to use when searching for plugins that are",
        "# specified without a fully qualified path name.",
        "#Path plugindir /usr/libexec/sudo",
        "# Core dumps:",
        "#   Set disablecoredump true|false",
        "# By default, sudo disables core dumps while it is executing (they",
        "# are re-enabled for the command that is run).",
        "# To aid in debugging sudo problems, you may wish to enable core",
        "# dumps by setting \"disablecoredump\" to false.",
        "#Set disablecoredump false",
        "# User groups:",
        "#   Set groupsource static|dynamic|adaptive",
        "# Sudo passes the user's group list to the policy plugin.",
        "# If the user is a member of the maximum number of groups (usually 16),",
        "# sudo will query the group database directly to be sure to include",
        "# the full list of groups.",
        "# On some systems, this can be expensive so the behavior is configurable.",
        "# The \"groupsource\" setting has three possible values:",
        "#   static   - use the user's list of groups returned by the kernel.",
        "#   dynamic  - query the group database to find the list of groups.",
        "#   adaptive - if user is in less than the maximum number of groups.",
        "#              use the kernel list, else query the group database.",
        "#Set groupsource static",
        "# Sudo interface probing:",
        "#   Set probeinterfaces true|false",
        "# By default, sudo will probe the system's network interfaces and",
        "# pass the IP address of each enabled interface to the policy plugin.",
        "# On systems with a large number of virtual interfaces this may take",
        "# a noticeable amount of time.",
        "#Set probeinterfaces false",
        "# Sudo debug files:",
        "#   Debug program /path/to/debuglog subsystem@priority[,subsyste@priority]",
        "# Sudo and related programs support logging debug information to a file.",
        "# The program is typically sudo, sudoers.so, sudoreplay, or visudo.",
        "# Subsystems vary based on the program; \"all\" matches all subsystems.",
        "# Priority may be crit, err, warn, notice, diag, info, trace, or debug.",
        "# Multiple subsystem@priority may be specified, separated by a comma.",
        "#Debug sudo /var/log/sudodebug all@debug",
        "#Debug sudoers.so /var/log/sudoersdebug all@debug"
    ],
    "see_also": [
        {
            "name": "sudoplugin",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/sudoplugin/5/json"
        },
        {
            "name": "sudoers",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/sudoers/5/json"
        },
        {
            "name": "sudo",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/sudo/8/json"
        }
    ]
}