{ "content": [ { "type": "text", "text": "# sudoers_timestamp (man)\n\n## NAME\n\nsudoerstimestamp — Sudoers Time Stamp Format\n\n## DESCRIPTION\n\nThe sudoers plugin uses per-user time stamp files for credential caching. Once a user has been\nauthenticated, they may use sudo without a password for a short period of time (15 minutes\nunless overridden by the timestamptimeout option). By default, sudoers uses a separate record\nfor each terminal, which means that a user's login sessions are authenticated separately. The\ntimestamptype option can be used to select the type of time stamp record sudoers will use.\n\n## Sections\n\n- **NAME**\n- **DESCRIPTION**\n- **LOCKING**\n- **SEE ALSO**\n- **HISTORY**\n- **AUTHORS**\n- **BUGS**\n- **SUPPORT**\n- **DISCLAIMER**\n- **Sudo 1.9.9 October 20, 2019 Sudo 1.9.9**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "sudoers_timestamp", "section": "", "mode": "man", "summary": "sudoerstimestamp — Sudoers Time Stamp Format", "synopsis": null, "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [], "see_also": [ { "name": "sudoers", "section": "5", "url": "https://www.chedong.com/phpMan.php/man/sudoers/5/json" }, { "name": "sudo", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/sudo/8/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "DESCRIPTION", "lines": 84, "subsections": [] }, { "name": "LOCKING", "lines": 17, "subsections": [] }, { "name": "SEE ALSO", "lines": 2, "subsections": [] }, { "name": "HISTORY", "lines": 46, "subsections": [] }, { "name": "AUTHORS", "lines": 8, "subsections": [] }, { "name": "BUGS", "lines": 3, "subsections": [] }, { "name": "SUPPORT", "lines": 3, "subsections": [] }, { "name": "DISCLAIMER", "lines": 5, "subsections": [] }, { "name": "Sudo 1.9.9 October 20, 2019 Sudo 1.9.9", "lines": 1, "subsections": [] } ], "sections": { "NAME": { "content": "sudoerstimestamp — Sudoers Time Stamp Format\n", "subsections": [] }, "DESCRIPTION": { "content": "The sudoers plugin uses per-user time stamp files for credential caching. Once a user has been\nauthenticated, they may use sudo without a password for a short period of time (15 minutes\nunless overridden by the timestamptimeout option). By default, sudoers uses a separate record\nfor each terminal, which means that a user's login sessions are authenticated separately. The\ntimestamptype option can be used to select the type of time stamp record sudoers will use.\n\nA multi-record time stamp file format was introduced in sudo 1.8.10 that uses a single file per\nuser. Previously, a separate file was used for each user and terminal combination unless tty-\nbased time stamps were disabled. The new format is extensible and records of multiple types\nand versions may coexist within the same file.\n\nAll records, regardless of type or version, begin with a 16-bit version number and a 16-bit\nrecord size.\n\nTime stamp records have the following structure:\n\n/* Time stamp entry types */\n#define TSGLOBAL 0x01 /* not restricted by tty or ppid */\n#define TSTTY 0x02 /* restricted by tty */\n#define TSPPID 0x03 /* restricted by ppid */\n#define TSLOCKEXCL 0x04 /* special lock record */\n\n/* Time stamp flags */\n#define TSDISABLED 0x01 /* entry disabled */\n#define TSANYUID 0x02 /* ignore uid, only valid in key */\n\nstruct timestampentry {\nunsigned short version; /* version number */\nunsigned short size; /* entry size */\nunsigned short type; /* TSGLOBAL, TSTTY, TSPPID */\nunsigned short flags; /* TSDISABLED, TSANYUID */\nuidt authuid; /* uid to authenticate as */\npidt sid; /* session ID associated with tty/ppid */\nstruct timespec starttime; /* session/ppid start time */\nstruct timespec ts; /* time stamp (CLOCKMONOTONIC) */\nunion {\ndevt ttydev; /* tty device number */\npidt ppid; /* parent pid */\n} u;\n};\n\nThe timestampentry struct fields are as follows:\n\nversion\nThe version number of the timestampentry struct. New entries are created with a version\nnumber of 2. Records with different version numbers may coexist in the same file but are\nnot inter-operable.\n\nsize The size of the record in bytes.\n\ntype The record type, currently TSGLOBAL, TSTTY, or TSPPID.\n\nflags\nZero or more record flags which can be bit-wise ORed together. Supported flags are\nTSDISABLED, for records disabled via sudo -k and TSANYUID, which is used only when\nmatching records.\n\nauthuid\nThe user-ID that was used for authentication. Depending on the value of the rootpw,\nrunaspw and targetpw options, the user-ID may be that of the invoking user, the root\nuser, the default runas user or the target user.\n\nsid The ID of the user's terminal session, if present. The session ID is only used when\nmatching records of type TSTTY.\n\nstarttime\nThe start time of the session leader for records of type TSTTY or of the parent process\nfor records of type TSPPID. The starttime is used to help prevent re-use of a time\nstamp record after a user has logged out. Not all systems support a method to easily re‐\ntrieve a process's start time. The starttime field was added in sudoers version 1.8.22\nfor the second revision of the timestampentry struct.\n\nts The actual time stamp. A monotonic time source (which does not move backward) is used if\nthe system supports it. Where possible, sudoers uses a monotonic timer that increments\neven while the system is suspended. The value of ts is updated each time a command is\nrun via sudo. If the difference between ts and the current time is less than the value\nof the timestamptimeout option, no password is required.\n\nu.ttydev\nThe device number of the terminal associated with the session for records of type TSTTY.\n\nu.ppid\nThe ID of the parent process for records of type TSPPID.\n", "subsections": [] }, "LOCKING": { "content": "In sudoers versions 1.8.10 through 1.8.14, the entire time stamp file was locked for exclusive\naccess when reading or writing to the file. Starting in sudoers 1.8.15, individual records are\nlocked in the time stamp file instead of the entire file and the lock is held for a longer pe‐\nriod of time. This scheme is described below.\n\nThe first record in the time stamp file is of type TSLOCKEXCL and is used as a lock record to\nprevent more than one sudo process from adding a new record at the same time. Once the desired\ntime stamp record has been located or created (and locked), the TSLOCKEXCL record is unlocked.\nThe lock on the individual time stamp record, however, is held until authentication is com‐\nplete. This allows sudoers to avoid prompting for a password multiple times when it is used\nmore than once in a pipeline.\n\nRecords of type TSGLOBAL cannot be locked for a long period of time since doing so would in‐\nterfere with other sudo processes. Instead, a separate lock record is used to prevent multiple\nsudo processes using the same terminal (or parent process ID) from prompting for a password as\nthe same time.\n", "subsections": [] }, "SEE ALSO": { "content": "sudoers(5), sudo(8)\n", "subsections": [] }, "HISTORY": { "content": "Originally, sudo used a single zero-length file per user and the file's modification time was\nused as the time stamp. Later versions of sudo added restrictions on the ownership of the time\nstamp files and directory as well as checks on the validity of the time stamp itself. Notable\nchanges were introduced in the following sudo versions:\n\n1.4.0\nSupport for tty-based time stamp file was added by appending the terminal name to the\ntime stamp file name.\n\n1.6.2\nThe time stamp file was replaced by a per-user directory which contained any tty-based\ntime stamp files.\n\n1.6.3p2\nThe target user name was added to the time stamp file name when the targetpw option was\nset.\n\n1.7.3\nInformation about the terminal device was stored in tty-based time stamp files for valid‐\nity checks. This included the terminal device numbers, inode number and, on systems\nwhere it was not updated when the device was written to, the inode change time. This\nhelped prevent re-use of the time stamp file after logout.\n\n1.8.6p7\nThe terminal session ID was added to tty-based time stamp files to prevent re-use of the\ntime stamp by the same user in a different terminal session. It also helped prevent re-\nuse of the time stamp file on systems where the terminal device's inode change time was\nupdated by writing.\n\n1.8.10\nA new, multi-record time stamp file format was introduced that uses a single file per\nuser. The terminal device's change time was not included since most systems now update\nthe change time after a write is performed as required by POSIX.\n\n1.8.15\nIndividual records are locked in the time stamp file instead of the entire file and the\nlock is held until authentication is complete.\n\n1.8.22\nThe start time of the terminal session leader or parent process is now stored in non-\nglobal time stamp records. This prevents re-use of the time stamp file after logout in\nmost cases.\n\nSupport was added for the kernel-based tty time stamps available in OpenBSD which do not\nuse an on-disk time stamp file.\n", "subsections": [] }, "AUTHORS": { "content": "Many people have worked on sudo over the years; this version consists of code written primarily\nby:\n\nTodd C. Miller\n\nSee the CONTRIBUTORS file in the sudo distribution (https://www.sudo.ws/contributors.html) for\nan exhaustive list of people who have contributed to sudo.\n", "subsections": [] }, "BUGS": { "content": "If you feel you have found a bug in sudo, please submit a bug report at\nhttps://bugzilla.sudo.ws/\n", "subsections": [] }, "SUPPORT": { "content": "Limited free support is available via the sudo-users mailing list, see\nhttps://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the archives.\n", "subsections": [] }, "DISCLAIMER": { "content": "sudo is provided “AS IS” and any express or implied warranties, including, but not limited to,\nthe implied warranties of merchantability and fitness for a particular purpose are disclaimed.\nSee the LICENSE file distributed with sudo or https://www.sudo.ws/license.html for complete de‐\ntails.\n", "subsections": [] }, "Sudo 1.9.9 October 20, 2019 Sudo 1.9.9": { "content": "", "subsections": [] } } } }