{
    "mode": "man",
    "parameter": "sudoers_timestamp",
    "section": "5",
    "url": "https://www.chedong.com/phpMan.php/man/sudoers_timestamp/5/json",
    "generated": "2026-11-08T05:43:04Z",
    "sections": {
        "NAME": {
            "content": "sudoerstimestamp — Sudoers Time Stamp Format\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The sudoers plugin uses per-user-ID time stamp files for credential caching.  Once a user has\nbeen  authenticated,  they  may  use  sudo  without a password for a short period of time (15\nminutes unless overridden by the timestamptimeout option).  By default, sudoers uses a sepa‐\nrate record for each terminal, which means that a user's  login  sessions  are  authenticated\nseparately.   The  timestamptype  option can be used to select the type of time stamp record\nsudoers will use.\n\nA multi-record time stamp file format was introduced in sudo 1.8.10 that uses a  single  file\nper user.  Previously, a separate file was used for each user and terminal combination unless\ntty-based  time  stamps  were disabled.  The new format is extensible and records of multiple\ntypes and versions may coexist within the same file.\n\nAll records, regardless of type or version, begin with a 16-bit version number and  a  16-bit\nrecord size.\n\nTime stamp records have the following structure:\n\n/* Time stamp entry types */\n#define TSGLOBAL               0x01    /* not restricted by tty or ppid */\n#define TSTTY                  0x02    /* restricted by tty */\n#define TSPPID                 0x03    /* restricted by ppid */\n#define TSLOCKEXCL             0x04    /* special lock record */\n\n/* Time stamp flags */\n#define TSDISABLED             0x01    /* entry disabled */\n#define TSANYUID               0x02    /* ignore uid, only valid in key */\n\nstruct timestampentry {\nunsigned short version;     /* version number */\nunsigned short size;        /* entry size */\nunsigned short type;        /* TSGLOBAL, TSTTY, TSPPID */\nunsigned short flags;       /* TSDISABLED, TSANYUID */\nuidt authuid;             /* uid to authenticate as */\npidt sid;                  /* session ID associated with tty/ppid */\nstruct timespec starttime; /* session/ppid start time */\nstruct timespec ts;         /* time stamp (CLOCKMONOTONIC) */\nunion {\ndevt ttydev;           /* tty device number */\npidt ppid;             /* parent pid */\n} u;\n};\n\nThe timestampentry struct fields are as follows:\n\nversion\nThe  version number of the timestampentry struct.  New entries are created with a ver‐\nsion number of 2.  Records with different version numbers may coexist in the same  file\nbut are not inter-operable.\n\nsize  The size of the record in bytes.\n\ntype  The record type, currently TSGLOBAL, TSTTY, or TSPPID.\n\nflags\nZero  or  more  record  flags which can be bit-wise ORed together.  Supported flags are\nTSDISABLED, for records disabled via sudo -k and TSANYUID, which is  used  only  when\nmatching records.\n\nauthuid\nThe  user-ID  that  was used for authentication.  Depending on the value of the rootpw,\nrunaspw and targetpw options, the user-ID may be that of the invoking  user,  the  root\nuser, the default runas user or the target user.\n\nsid   The  ID  of  the user's terminal session, if present.  The session ID is only used when\nmatching records of type TSTTY.\n\nstarttime\nThe start time of the session leader for records  of  type  TSTTY  or  of  the  parent\nprocess  for records of type TSPPID.  The starttime is used to help prevent re-use of\na time stamp record after a user has logged out.  Not all systems support a  method  to\neasily retrieve a process's start time.  The starttime field was added in sudoers ver‐\nsion 1.8.22 for the second revision of the timestampentry struct.\n\nts    The  actual time stamp.  A monotonic time source (which does not move backward) is used\nif the system supports it.  Where possible, sudoers uses a monotonic timer that  incre‐\nments  even while the system is suspended.  The value of ts is updated each time a com‐\nmand is run via sudo.  If the difference between ts and the current time is  less  than\nthe value of the timestamptimeout option, no password is required.\n\nu.ttydev\nThe  device  number  of  the  terminal  associated with the session for records of type\nTSTTY.\n\nu.ppid\nThe ID of the parent process for records of type TSPPID.\n",
            "subsections": []
        },
        "LOCKING": {
            "content": "In sudoers versions 1.8.10 through 1.8.14, the entire time stamp file was locked  for  exclu‐\nsive  access  when  reading  or  writing to the file.  Starting in sudoers 1.8.15, individual\nrecords are locked in the time stamp file instead of the entire file and the lock is held for\na longer period of time.  This scheme is described below.\n\nThe first record in the time stamp file is of type TSLOCKEXCL and is used as a  lock  record\nto  prevent  more  than one sudo process from adding a new record at the same time.  Once the\ndesired time stamp record has been located or created (and locked), the TSLOCKEXCL record is\nunlocked.  The lock on the individual time stamp record, however, is held  until  authentica‐\ntion  is complete.  This allows sudoers to avoid prompting for a password multiple times when\nit is used more than once in a pipeline.\n\nRecords of type TSGLOBAL cannot be locked for a long period of time since doing so would in‐\nterfere with other sudo processes.  Instead, a separate lock record is used to prevent multi‐\nple sudo processes using the same terminal (or parent process ID) from prompting for a  pass‐\nword as the same time.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "sudoers(5), sudo(8)\n",
            "subsections": []
        },
        "HISTORY": {
            "content": "Originally, sudo used a single zero-length file per user and the file's modification time was\nused  as  the  time stamp.  Later versions of sudo added restrictions on the ownership of the\ntime stamp files and directory as well as checks on the validity of the  time  stamp  itself.\nNotable changes were introduced in the following sudo versions:\n\n1.4.0\nSupport  for  tty-based time stamp file was added by appending the terminal name to the\ntime stamp file name.\n\n1.6.2\nThe time stamp file was replaced by a per-user directory which contained any  tty-based\ntime stamp files.\n\n1.6.3p2\nThe target user name was added to the time stamp file name when the targetpw option was\nset.\n\n1.7.3\nInformation  about the terminal device was stored in tty-based time stamp files for va‐\nlidity checks.  This included the terminal device numbers, inode number and, on systems\nwhere it was not updated when the device was written to, the inode change  time.   This\nhelped prevent re-use of the time stamp file after logout.\n\n1.8.6p7\nThe  terminal  session  ID was added to tty-based time stamp files to prevent re-use of\nthe time stamp by the same user in a different terminal session.  It also  helped  pre‐\nvent  re-use of the time stamp file on systems where the terminal device's inode change\ntime was updated by writing.\n\n1.8.10\nA new, multi-record time stamp file format was introduced that uses a single  file  per\nuser.  The terminal device's change time was not included since most systems now update\nthe change time after a write is performed as required by POSIX.\n\n1.8.15\nIndividual records are locked in the time stamp file instead of the entire file and the\nlock is held until authentication is complete.\n\n1.8.22\nThe  start  time of the terminal session leader or parent process is now stored in non-\nglobal time stamp records.  This prevents re-use of the time stamp file after logout in\nmost cases.\n\nSupport was added for the kernel-based tty time stamps available in  OpenBSD  which  do\nnot use an on-disk time stamp file.\n\n1.9.15\nTime  stamp  file  path names are now based on the invoking user-ID instead of the user\nname.  This avoids problems with user names that include a path separator character.\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "Many people have worked on sudo over the years; this version consists of code written primar‐\nily by:\n\nTodd C. Miller\n\nSee the CONTRIBUTORS.md file in the  sudo  distribution  (https://www.sudo.ws/about/contribu‐\ntors/) for an exhaustive list of people who have contributed to sudo.\n",
            "subsections": []
        },
        "BUGS": {
            "content": "If   you   believe  you  have  found  a  bug  in  sudo,  you  can  submit  a  bug  report  at\nhttps://bugzilla.sudo.ws/\n",
            "subsections": []
        },
        "SUPPORT": {
            "content": "Limited   free   support   is   available   via   the   sudo-users    mailing    list,    see\nhttps://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the archives.\n",
            "subsections": []
        },
        "DISCLAIMER": {
            "content": "sudo  is  provided  “AS IS” and any express or implied warranties, including, but not limited\nto, the implied warranties of merchantability and fitness for a particular purpose  are  dis‐\nclaimed.  See the LICENSE.md file distributed with sudo or https://www.sudo.ws/about/license/\nfor complete details.\n\nSudo 1.9.15p5                            September 20, 2023                     SUDOERSTIMESTAMP(5)",
            "subsections": []
        }
    },
    "summary": "sudoerstimestamp — Sudoers Time Stamp Format",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "sudoers",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/sudoers/5/json"
        },
        {
            "name": "sudo",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/sudo/8/json"
        }
    ]
}