Manual: sudoedit
SUDO(8) sudo-rs SUDO(8)
NAME
sudo, sudoedit - execute a command as another user
SYNOPSIS
sudo -h | -K | -k | -V
sudo [-u user] [-g group] [-D directory] [-BbknS] [-i | -s] [VAR=value] []
sudo -v [-BknS] [-u user] [-g group]
sudo -l [-BknS] [-U user] [-u user] [-g group] [command [arg ...]]
sudo -e [-BknS] [-u user] [-g group] file ...
sudoedit [-BknS] [-u user] [-g group] file ...
DESCRIPTION
sudo allows a user that is permitted to do so to execute a command as another user (for example
root). Permissions are specified by a security policy specified in /etc/sudoers (see sudoers(5)).
Sudo-rs is a safety oriented and memory safe re-implementation of the original sudo implementation by
Todd Miller.
When a command is run, a session record is stored for that specific session allowing users to run adā
ditional commands without having to re-authenticate. The timeout for session records can be speciā
fied in the policy.
Some care is taken to pass signals received by sudo-rs to the child process, even if that process
runs in its own pseudo terminal.
On systems where sudo is the primary method of gaining superuser privileges, it is imperative to
avoid syntax errors in the /etc/sudoers file. Changes to this file should be made using the viā
sudo(8) utility which will ensure that no syntax errors are introduced.
OPTIONS
-A, --askpass
Normally, if sudo requires a password, it will read it from the userās terminal. If the -A
(askpass) option is specified, a (possibly graphical) helper program is executed to read the
userās password and output the password to the standard output. If the SUDO_ASKPASS environā
ment variable is set, it specifies the path to the helper program. If no askpass program is
available, sudo will exit with an error.
-B, --bell
Ring the bell as part of the password prompt when a terminal is present.
-b, --background
Run the given command in the background. It is not possible to use shell job control to maā
nipulate background processes started by sudo-rs. Most interactive commands will fail to work
properly in background mode.
-D directory, --chdir=directory
Run the command in the specified directory instead of the current working directory. The seā
curity policy may return an error if the user does not have the permission to specify the
working directory.
-g group, --group=group
Use this group as the primary group instead of using the primary group specified in the passā
word database for the target user.
-h, --help
Show a help message.
-i, --login
Run the shell specified by the target userās password database entry as a login shell. This
means that login-specific resource files such as .profile, .bash_profile or .login will be
read by the shell. If a command is specified, it is passed to the shell using the -c option.
-K, --remove-timestamp
Removes every cached session record for the user, regardless of where the command is executed.
The next time sudo-rs is run, authentication will take place if the policy requires it. No
password is required to run this command.
-k, --reset-timestamp
When used without a command, invalidates the userās session record for the current session.
The next time sudo-rs is run, authentication will take place if the policy requires it.
When used in conjunction with a command or an option that may require a password, this option
will cause sudo-rs to ignore the userās session record. As a result, authentication will take
place if the policy requires it. When used in conjunction with a command no invalidation of
existing session records will take place.
-n, --non-interactive
Avoid prompting the user for input of any kind. If any input is required for the command to
run, sudo-rs will display an error message and exit.
p, --prompt=prompt
Use a custom authentication prompt with optional escape sequences. The following percent
(ā%ā) escape sequences are supported:
%H expanded to the local host name
%h expanded to the local host name without the domain name
%p expanded to the name of the user whose password is being requested
(this respects the rootpw, targetpw flags)
%U expanded to the login name of the user the command will be run as
(defaults to root unless the -u option is also specified)
%u expanded to the invoking user's login name
%% two consecutive ā%ā characters are collapsed into a single ā%ā character
The custom prompt will override the default prompt or the one specified by the SUDO_PROMPT enā
vironment variable. No prompt will suppress the prompt provided by PAM, unless the requested
prompt is empty ("")
-S, --stdin
Read from standard input instead of using the terminal device.
-s, --shell
Run the shell specified by the SHELL environment variable. If no shell was specified, the
shell from the userās password database entry will be used instead. If a command is speciā
fied, it is passed to the shell using the -c option.
--preserve-env=list
Indicates to the security policy that the user wishes to add the comma-separated list of enviā
ronment variables to those preserved from the userās environment. The security policy may reā
turn an error if the user does not have permission to preserve the environment. This option
may be specified multiple times.
-e, --edit, sudoedit
Edit one or more files instead of running a command. In lieu of a path name, the string āsuā
doeditā is used when consulting the security policy. If the user is authorized by the policy,
the following steps are taken:
1. Temporary copies are made of the files to be edited with the owner set to the invoking
user.
2. The editor specified by the policy is run to edit the temporary files. The sudoers policy
uses the SUDO_EDITOR, VISUAL and EDITOR environment variables (in that order). If none of
SUDO_EDITOR, VISUAL or EDITOR are set, the first program listed in the editor sudoers(5)
option is used.
3. If they have been modified, the content of the temporary files is copied back to the origiā
nals and the temporary versions are removed.
To help prevent the editing of unauthorized files, the following restrictions are enforced
(unless the user is root):
ā¢ Symbolic links may not be edited.
ā¢ If any component of the path leading to the file is writable by the invoking user, the file
may not be edited.
ā¢ Users are never allowed to edit device special files.
If the specified file does not exist, it will be created. Unlike most commands run by sudo,
the editor is run with the invoking userās environment unmodified. If the temporary file beā
comes empty after editing, the user will be prompted before it is installed.
-u user, --user=user
Run the command as another user than the default (root).
-V, --version
Display the current version of sudo-rs.
-v, --validate
Update the session record for the current session, authenticating the user if necessary.
-l, --list
List userās privileges or check a specific command; use twice for longer format
-U, --other-user=user
Used in list mode, display privileges for another user
-- Indicates the end of the sudo-rs options and start of the command.
Environment variables to be set for the command may be passed on the command line in the form of
VAR=value. Variables passed on the command line are subject to restrictions imposed by the security
policy. Variables passed on the command line are subject to the same restrictions as normal environā
ment variables with one important exception: If the command to be run has the SETENV tag set or the
command matched is ALL, the user may set variables that would otherwise be forbidden. See sudoers(5)
for more information.
SEE ALSO
su(1), sudoers(5), visudo(8)
sudo-rs 0.2.13 SUDO(8)