# sudo

## NAME



           **sudo** , **sudoedit** — execute a command as another user
    


## SYNOPSIS



           **sudo -h** | **-K** | **-k** | **-V sudo -v**[**-ABkNnS**] [**-g** _group_] [**-h** _host_] [**-p**
           _prompt_] [**-u** _user_] **sudo -l**[**-ABkNnS**] [**-g** _group_] [**-h** _host_] [**-p**
           _prompt_] [**-U** _user_] [**-u** _user_] [_command_ [_arg ..._]] **sudo**[**-ABbEHnPS**]
           [**-C** _num_] [**-D** _directory_] [**-g** _group_] [**-h** _host_] [**-p** _prompt_] [**-R**
           _directory_] [**-T** _timeout_] [**-u** _user_] [_VAR_ =_value_] [**-i** | **-s**] [_command_
           [_arg ..._]] **sudoedit**[**-ABkNnS**] [**-C** _num_] [**-D** _directory_] [**-g** _group_]
           [**-h** _host_] [**-p** _prompt_] [**-R** _directory_] [**-T** _timeout_] [**-u** _user_]
           _file ..._
    


## DESCRIPTION



           **sudo** , allows a permitted user to execute a _command_ as the
           superuser or another user, as specified by the security policy.
           The invoking user's real (_not_ effective) user-ID is used to
           determine the user name with which to query the security policy.
    
           **sudo** , supports a plugin architecture for security policies,
           auditing, and input/output logging.  Third parties can develop and
           distribute their own plugins to work seamlessly with the **sudo** ,
           front-end.  The default security policy is _sudoers_ , which is
           configured via the file _/etc/sudoers_ , or via LDAP.  See the
           “Plugins” section for more information.
    
           The security policy determines what privileges, if any, a user has
           to run **sudo** ,.  The policy may require that users authenticate
           themselves with a password or another authentication mechanism.
           If authentication is required, **sudo** , will exit if the user's
           password is not entered within a configurable time limit.  This
           limit is policy-specific; the default password prompt timeout for
           the _sudoers_ security policy is 5 minutes.
    
           Security policies may support credential caching to allow the user
           to run **sudo** , again for a period of time without requiring
           authentication.  By default, the _sudoers_ policy caches credentials
           on a per-terminal basis for 5 minutes.  See the _timestamp_type_ and
           _timestamp_timeout_ options in _sudoers_(5) for more information.  By
           running **sudo** , with the **-v** option, a user can update the cached
           credentials without running a _command_.
    
           On systems where **sudo** , is the primary method of gaining superuser
           privileges, it is imperative to avoid syntax errors in the
           security policy configuration files.  For the default security
           policy, _sudoers_(5), changes to the configuration files should be
           made using the _visudo_(8) utility which will ensure that no syntax
           errors are introduced.
    
           When invoked as **sudoedit** , the **-e** option (described below), is
           implied.
    
           Security policies and audit plugins may log successful and failed
           attempts to run **sudo** ,.  If an I/O plugin is configured, the
           running _command_ 's input and output may be logged as well.
    
           The options are as follows:
    
           **-A** , **--askpass**
                   Normally, if **sudo** , requires a password, it will read it
                   from the user's terminal.  If the **-A**(_askpass_) option is
                   specified, a (possibly graphical) helper program is
                   executed to read the user's password and output the
                   password to the standard output.  If the SUDO_ASKPASS
                   environment variable is set, it specifies the path to the
                   helper program.  Otherwise, if _sudo.conf_(5) contains a
                   line specifying the askpass program, that value will be
                   used.  For example:
    
                       # Path to askpass helper program
                       Path askpass /usr/X11R6/bin/ssh-askpass
    
                   If no askpass program is available, **sudo** , will exit with
                   an error.
    
           **-B** , **--bell**
                   Ring the bell as part of the password prompt when a
                   terminal is present.  This option has no effect if an
                   askpass program is used.
    
           **-b** , **--background**
                   Run the given _command_ in the background.  It is not
                   possible to use shell job control to manipulate background
                   processes started by **sudo** ,.  Most interactive _command_ s
                   will fail to work properly in background mode.
    
           **-C** _num_ , **--close-from** =_num_
                   Close all file descriptors greater than or equal to _num_
                   before executing a _command_.  Values less than three are
                   not permitted.  By default, **sudo** , will close all open file
                   descriptors other than standard input, standard output,
                   and standard error when executing a _command_.  The security
                   policy may restrict the user's ability to use this option.
                   The _sudoers_ policy only permits use of the **-C** option when
                   the administrator has enabled the _closefrom_override_
                   option.
    
           **-D** _directory_ , **--chdir** =_directory_
                   Run the _command_ in the specified _directory_ instead of the
                   current working directory.  The security policy may return
                   an error if the user does not have permission to specify
                   the working directory.
    
           **-E** , **--preserve-env**
                   Indicates to the security policy that the user wishes to
                   preserve their existing environment variables.  The
                   security policy may return an error if the user does not
                   have permission to preserve the environment.
    
           **--preserve-env=list**
                   Indicates to the security policy that the user wishes to
                   add the comma-separated list of environment variables to
                   those preserved from the user's environment.  The security
                   policy may return an error if the user does not have
                   permission to preserve the environment.  This option may
                   be specified multiple times.
    
           **-e** , **--edit**
                   Edit one or more _file_ s instead of running a _command_.  In
                   lieu of a path name, the string "sudoedit" is used when
                   consulting the security policy.  If the user is authorized
                   by the policy, the following steps are taken:
    
                       1.   Temporary copies are made of the files to be
                            edited with the owner set to the invoking user.
    
                       2.   The editor specified by the policy is run to edit
                            the temporary files.  The _sudoers_ policy uses the
                            SUDO_EDITOR, VISUAL and EDITOR environment
                            variables (in that order).  If none of
                            SUDO_EDITOR, VISUAL or EDITOR are set, the first
                            program listed in the _editor sudoers_(5) option is
                            used.
    
                       3.   If they have been modified, the temporary files
                            are copied back to their original location and
                            the temporary versions are removed.
    
                   To help prevent the editing of unauthorized files, the
                   following restrictions are enforced unless explicitly
                   allowed by the security policy:
    
                    **•** Symbolic links may not be edited (version 1.8.15 and
                       higher).
    
                    **•** Symbolic links along the path to be edited are not
                       followed when the parent directory is writable by the
                       invoking user unless that user is root (version 1.8.16
                       and higher).
    
                    **•** Files located in a directory that is writable by the
                       invoking user may not be edited unless that user is
                       root (version 1.8.16 and higher).
    
                   Users are never allowed to edit device special files.
    
                   If the specified file does not exist, it will be created.
                   Unlike most _command_ s run by _sudo_ , the editor is run with
                   the invoking user's environment unmodified.  If the
                   temporary file becomes empty after editing, the user will
                   be prompted before it is installed.  If, for some reason,
                   **sudo** , is unable to update a file with its edited version,
                   the user will receive a warning and the edited copy will
                   remain in a temporary file.
    
           **-g** _group_ , **--group** =_group_
                   Run the _command_ with the primary group set to _group_
                   instead of the primary group specified by the target
                   user's password database entry.  The _group_ may be either a
                   group name or a numeric group-ID (GID) prefixed with the
                   ‘#’ character (e.g., ‘#0’ for GID 0).  When running a
                   _command_ as a GID, many shells require that the ‘#’ be
                   escaped with a backslash (‘\’).  If no **-u** option is
                   specified, the _command_ will be run as the invoking user.
                   In either case, the primary group will be set to _group_.
                   The _sudoers_ policy permits any of the target user's groups
                   to be specified via the **-g** option as long as the **-P** option
                   is not in use.
    
           **-H** , **--set-home**
                   Request that the security policy set the HOME environment
                   variable to the home directory specified by the target
                   user's password database entry.  Depending on the policy,
                   this may be the default behavior.
    
           **-h** , **--help**
                   Display a short help message to the standard output and
                   exit.
    
           **-h** _host_ , **--host** =_host_
                   Run the _command_ on the specified _host_ if the security
                   policy plugin supports remote _command_ s. The _sudoers_ plugin
                   does not currently support running remote _command_ s. This
                   may also be used in conjunction with the **-l** option to list
                   a user's privileges for the remote host.
    
           **-i** , **--login**
                   Run the shell specified by the target user's password
                   database entry as a login shell.  This means that login-
                   specific resource files such as _.profile_ , _.bash_profile_ ,
                   or _.login_ will be read by the shell.  If a _command_ is
                   specified, it is passed to the shell as a simple _command_
                   using the **-c** option.  The _command_ and any _arg_ s are
                   concatenated, separated by spaces, after escaping each
                   character (including white space) with a backslash (‘\’)
                   except for alphanumerics, underscores, hyphens, and dollar
                   signs.  If no _command_ is specified, an interactive shell
                   is executed.  **sudo** , attempts to change to that user's home
                   directory before running the shell.  The _command_ is run
                   with an environment similar to the one a user would
                   receive at log in.  Most shells behave differently when a
                   _command_ is specified as compared to an interactive
                   session; consult the shell's manual for details.  The
                   _Command environment_ section in the _sudoers_(5) manual
                   documents how the **-i** option affects the environment in
                   which a _command_ is run when the _sudoers_ policy is in use.
    
           **-K** , **--remove-timestamp**
                   Similar to the **-k** option, except that it removes every
                   cached credential for the user, regardless of the terminal
                   or parent process ID.  The next time **sudo** , is run, a
                   password must be entered if the security policy requires
                   authentication.  It is not possible to use the **-K** option
                   in conjunction with a _command_ or other option.  This
                   option does not require a password.  Not all security
                   policies support credential caching.
    
           **-k** , **--reset-timestamp**
                   When used without a _command_ , invalidates the user's cached
                   credentials for the current session.  The next time **sudo** ,
                   is run in the session, a password must be entered if the
                   security policy requires authentication.  By default, the
                   **sudoers** policy uses a separate record in the credential
                   cache for each terminal (or parent process ID if no
                   terminal is present).  This prevents the **-k** option from
                   interfering with **sudo** , commands run in a different
                   terminal session.  See the _timestamp_type_ option in
                   _sudoers_(5) for more information.  This option does not
                   require a password, and was added to allow a user to
                   revoke **sudo** , permissions from a _.logout_ file.
    
                   When used in conjunction with a _command_ or an option that
                   may require a password, this option will cause **sudo** , to
                   ignore the user's cached credentials.  As a result, **sudo** ,
                   will prompt for a password (if one is required by the
                   security policy) and will not update the user's cached
                   credentials.
    
                   Not all security policies support credential caching.
    
           **-l** , **--list**
                   If no _command_ is specified, list the privileges for the
                   invoking user (or the _user_ specified by the **-U** option) on
                   the current host.  A longer list format is used if this
                   option is specified multiple times and the security policy
                   supports a verbose output format.
    
                   If a _command_ is specified and is permitted by the security
                   policy for the invoking user (or the, _user_ specified by
                   the **-U** option) on the current host, the fully-qualified
                   path to the _command_ is displayed along with any _arg_ s. If
                   **-l** is specified more than once (and the security policy
                   supports it), the matching rule is displayed in a verbose
                   format along with the _command_.  If a _command_ is specified
                   but not allowed by the policy, **sudo** , will exit with a
                   status value of 1.
    
           **-N** , **--no-update**
                   Do not update the user's cached credentials, even if the
                   user successfully authenticates.  Unlike the **-k** flag,
                   existing cached credentials are used if they are valid.
                   To detect when the user's cached credentials are valid (or
                   when no authentication is required), the following can be
                   used:
    
                       sudo -Nnv
    
                   Not all security policies support credential caching.
    
           **-n** , **--non-interactive**
                   Avoid prompting the user for input of any kind.  If a
                   password is required for the _command_ to run, **sudo** , will
                   display an error message and exit.
    
           **-P** , **--preserve-groups**
                   Preserve the invoking user's group vector unaltered.  By
                   default, the _sudoers_ policy will initialize the group
                   vector to the list of groups the target user is a member
                   of.  The real and effective group-IDs, however, are still
                   set to match the target user.
    
           **-p** _prompt_ , **--prompt** =_prompt_
                   Use a custom password prompt with optional escape
                   sequences.  The following percent (‘%’) escape sequences
                   are supported by the _sudoers_ policy:
    
                   %H  expanded to the host name including the domain name
                       (only if the machine's host name is fully qualified or
                       the _fqdn_ option is set in _sudoers_(5))
    
                   %h  expanded to the local host name without the domain
                       name
    
                   %p  expanded to the name of the user whose password is
                       being requested (respects the _rootpw_ , _targetpw_ , and
                       _runaspw_ flags in _sudoers_(5))
    
                   %U  expanded to the login name of the user the _command_
                       will be run as (defaults to root unless the **-u** option
                       is also specified)
    
                   %u  expanded to the invoking user's login name
    
                   %%  two consecutive ‘%’ characters are collapsed into a
                       single ‘%’ character
    
                   The custom prompt will override the default prompt
                   specified by either the security policy or the SUDO_PROMPT
                   environment variable.  On systems that use PAM, the custom
                   prompt will also override the prompt specified by a PAM
                   module unless the _passprompt_override_ flag is disabled in
                   _sudoers_.
    
           **-R** _directory_ , **--chroot** =_directory_
                   Change to the specified root _directory_ (see _chroot_(8))
                   before running the _command_.  The security policy may
                   return an error if the user does not have permission to
                   specify the root directory.
    
                   This option is deprecated and will be removed in a future
                   version of **sudo** ,.
    
           **-S** , **--stdin**
                   Write the prompt to the standard error and read the
                   password from the standard input instead of using the
                   terminal device.
    
           **-s** , **--shell**
                   Run the shell specified by the SHELL environment variable
                   if it is set or the shell specified by the invoking user's
                   password database entry.  If a _command_ is specified, it is
                   passed to the shell as a simple command using the **-c**
                   option.  The _command_ and any _arg_ s are concatenated,
                   separated by spaces, after escaping each character
                   (including white space) with a backslash (‘\’) except for
                   alphanumerics, underscores, hyphens, and dollar signs.  If
                   no _command_ is specified, an interactive shell is executed.
                   Most shells behave differently when a _command_ is specified
                   as compared to an interactive session; consult the shell's
                   manual for details.
    
           **-U** _user_ , **--other-user** =_user_
                   Used in conjunction with the **-l** option to list the
                   privileges for _user_ instead of for the invoking user.  The
                   security policy may restrict listing other users'
                   privileges.  When using the _sudoers_ policy, the **-U** option
                   is restricted to the root user and users with either the
                   “list” priviege for the specified _user_ or the ability to
                   run any _command_ as root or _user_ on the current host.
    
           **-T** _timeout_ , **--command-timeout** =_timeout_
                   Used to set a timeout for the _command_.  If the timeout
                   expires before the _command_ has exited, the _command_ will be
                   terminated.  The security policy may restrict the user's
                   ability to set timeouts.  The _sudoers_ policy requires that
                   user-specified timeouts be explicitly enabled.
    
           **-u** _user_ , **--user** =_user_
                   Run the _command_ as a user other than the default target
                   user (usually **root**).  The _user_ may be either a user name
                   or a numeric user-ID (UID) prefixed with the ‘#’ character
                   (e.g., ‘#0’ for UID 0).  When running _command_ s as a UID,
                   many shells require that the ‘#’ be escaped with a
                   backslash (‘\’).  Some security policies may restrict UIDs
                   to those listed in the password database.  The _sudoers_
                   policy allows UIDs that are not in the password database
                   as long as the _targetpw_ option is not set.  Other security
                   policies may not support this.
    
           **-V** , **--version**
                   Print the **sudo** , version string as well as the version
                   string of any configured plugins.  If the invoking user is
                   already root, the **-V** option will display the options
                   passed to configure when **sudo** , was built; plugins may
                   display additional information such as default options.
    
           **-v** , **--validate**
                   Update the user's cached credentials, authenticating the
                   user if necessary.  For the _sudoers_ plugin, this extends
                   the **sudo** , timeout for another 5 minutes by default, but
                   does not run a _command_.  Not all security policies support
                   cached credentials.
    
           **--** The **--** is used to delimit the end of the **sudo** , options.
                   Subsequent options are passed to the _command_.
    
           Options that take a value may only be specified once unless
           otherwise indicated in the description.  This is to help guard
           against problems caused by poorly written scripts that invoke **sudo**
           with user-controlled input.
    
           Environment variables to be set for the _command_ may also be passed
           as options to **sudo** , in the form _VAR_ =_value_ , for example
           LD_LIBRARY_PATH=_/usr/local/pkg/lib_.  Environment variables may be
           subject to restrictions imposed by the security policy plugin.
           The _sudoers_ policy subjects environment variables passed as
           options to the same restrictions as existing environment variables
           with one important difference.  If the _setenv_ option is set in
           _sudoers_ , the _command_ to be run has the SETENV tag set or the
           _command_ matched is **ALL** , the user may set variables that would
           otherwise be forbidden.  See _sudoers_(5) for more information.
    


## COMMAND EXECUTION



           When **sudo** , executes a _command_ , the security policy specifies the
           execution environment for the _command_.  Typically, the real and
           effective user and group and IDs are set to match those of the
           target user, as specified in the password database, and the group
           vector is initialized based on the group database (unless the **-P**
           option was specified).
    
           The following parameters may be specified by security policy:
    
           **•** real and effective user-ID
    
           **•** real and effective group-ID
    
           **•** supplementary group-IDs
    
           **•** the environment list
    
           **•** current working directory
    
           **•** file creation mode mask (umask)
    
           **•** scheduling priority (aka nice value)
    
       **Process model**
           There are two distinct ways **sudo** , can run a _command_.
    
           If an I/O logging plugin is configured to log terminal I/O, or if
           the security policy explicitly requests it, a new pseudo-terminal
           (“pty”) is allocated and _fork_(2) is used to create a second **sudo** ,
           process, referred to as the _monitor_.  The _monitor_ creates a new
           terminal session with itself as the leader and the pty as its
           controlling terminal, calls _fork_(2) again, sets up the execution
           environment as described above, and then uses the _execve_(2) system
           call to run the _command_ in the child process.  The _monitor_ exists
           to relay job control signals between the user's terminal and the
           pty the _command_ is being run in.  This makes it possible to
           suspend and resume the _command_ normally.  Without the _monitor_ , the
           _command_ would be in what POSIX terms an “orphaned process group”
           and it would not receive any job control signals from the kernel.
           When the _command_ exits or is terminated by a signal, the _monitor_
           passes the _command_ 's exit status to the main **sudo** , process and
           exits.  After receiving the _command_ 's exit status, the main **sudo** ,
           process passes the _command_ 's exit status to the security policy's
           close function, as well as the close function of any configured
           audit plugin, and exits.  This mode is the default for sudo
           versions 1.9.14 and above when using the sudoers policy.
    
           If no pty is used, **sudo** , calls _fork_(2), sets up the execution
           environment as described above, and uses the _execve_(2) system call
           to run the _command_ in the child process.  The main **sudo** , process
           waits until the _command_ has completed, then passes the _command_ 's
           exit status to the security policy's close function, as well as
           the close function of any configured audit plugins, and exits.  As
           a special case, if the policy plugin does not define a close
           function, **sudo** , will execute the _command_ directly instead of
           calling _fork_(2) first.  The _sudoers_ policy plugin will only define
           a close function when I/O logging is enabled, a pty is required,
           an SELinux role is specified, the _command_ has an associated
           timeout, or the _pam_session_ or _pam_setcred_ options are enabled.
           Both _pam_session_ and _pam_setcred_ are enabled by default on systems
           using PAM.  This mode is the default for sudo versions prior to
           1.9.14 when using the sudoers policy.
    
           On systems that use PAM, the security policy's close function is
           responsible for closing the PAM session.  It may also log the
           _command_ 's exit status.
    
       **Signal handling**
           When the _command_ is run as a child of the **sudo** , process, **sudo** ,
           will relay signals it receives to the _command_.  The SIGINT and
           SIGQUIT signals are only relayed when the _command_ is being run in
           a new pty or when the signal was sent by a user process, not the
           kernel.  This prevents the _command_ from receiving SIGINT twice
           each time the user enters control-C.  Some signals, such as
           SIGSTOP and SIGKILL, cannot be caught and thus will not be relayed
           to the _command_.  As a general rule, SIGTSTP should be used instead
           of SIGSTOP when you wish to suspend a _command_ being run by **sudo** ,.
    
           As a special case, **sudo** , will not relay signals that were sent by
           the _command_ it is running.  This prevents the _command_ from
           accidentally killing itself.  On some systems, the _reboot_(8)
           utility sends SIGTERM to all non-system processes other than
           itself before rebooting the system.  This prevents **sudo** , from
           relaying the SIGTERM signal it received back to _reboot_(8), which
           might then exit before the system was actually rebooted, leaving
           it in a half-dead state similar to single user mode.  Note,
           however, that this check only applies to the _command_ run by **sudo** ,
           and not any other processes that the _command_ may create.  As a
           result, running a script that calls _reboot_(8) or _shutdown_(8) via
           **sudo** , may cause the system to end up in this undefined state
           unless the _reboot_(8) or _shutdown_(8) are run using the **exec**()
           family of functions instead of **system**() (which interposes a shell
           between the _command_ and the calling process).
    
       **Plugins**
           Plugins may be specified via _Plugin_ directives in the _sudo.conf_(5)
           file.  They may be loaded as dynamic shared objects (on systems
           that support them), or compiled directly into the **sudo** , binary.
           If no _sudo.conf_(5) file is present, or if it doesn't contain any
           _Plugin_ lines, **sudo** , will use _sudoers_(5) for the policy, auditing,
           and I/O logging plugins.  See the _sudo.conf_(5) manual for details
           of the _/etc/sudo.conf_ file and the _sudo_plugin_(5) manual for more
           information about the **sudo** , plugin architecture.
    


## EXIT VALUE



           Upon successful execution of a _command_ , the exit status from **sudo** ,
           will be the exit status of the program that was executed.  If the
           _command_ terminated due to receipt of a signal, **sudo** , will send
           itself the same signal that terminated the _command_.
    
           If the **-l** option was specified without a _command_ , **sudo** , will exit
           with a value of 0 if the user is allowed to run **sudo** , and they
           authenticated successfully (as required by the security policy).
           If a _command_ is specified with the **-l** option, the exit value will
           only be 0 if the _command_ is permitted by the security policy,
           otherwise it will be 1.
    
           If there is an authentication failure, a configuration/permission
           problem, or if the given _command_ cannot be executed, **sudo** , exits
           with a value of 1.  In the latter case, the error string is
           printed to the standard error.  If **sudo** , cannot _stat_(2) one or
           more entries in the user's PATH, an error is printed to the
           standard error.  (If the directory does not exist or if it is not
           really a directory, the entry is ignored and no error is printed.)
           This should not happen under normal circumstances.  The most
           common reason for _stat_(2) to return “permission denied” is if you
           are running an automounter and one of the directories in your PATH
           is on a machine that is currently unreachable.
    


## SECURITY NOTES



           **sudo** , tries to be safe when executing external _command_ s.
    
           To prevent command spoofing, **sudo** , checks "." and "" (both
           denoting current directory) last when searching for a _command_ in
           the user's PATH (if one or both are in the PATH).  Depending on
           the security policy, the user's PATH environment variable may be
           modified, replaced, or passed unchanged to the program that **sudo** ,
           executes.
    
           Users should _never_ be granted **sudo** , privileges to execute files
           that are writable by the user or that reside in a directory that
           is writable by the user.  If the user can modify or replace the
           _command_ there is no way to limit what additional _command_ s they can
           run.
    
           By default, **sudo** , will only log the _command_ it explicitly runs.
           If a user runs a _command_ such as ‘sudo su’ or ‘sudo sh’,
           subsequent _command_ s run from that shell are not subject to **sudo** 's
           security policy.  The same is true for _command_ s that offer shell
           escapes (including most editors).  If I/O logging is enabled,
           subsequent _command_ s will have their input and/or output logged,
           but there will not be traditional logs for those _command_ s. Because
           of this, care must be taken when giving users access to _command_ s
           via **sudo** , to verify that the _command_ does not inadvertently give
           the user an effective root shell.  For information on ways to
           address this, see the _Preventing shell escapes_ section in
           _sudoers_(5).
    
           To prevent the disclosure of potentially sensitive information,
           **sudo** , disables core dumps by default while it is executing (they
           are re-enabled for the _command_ that is run).  This historical
           practice dates from a time when most operating systems allowed
           set-user-ID processes to dump core by default.  To aid in
           debugging **sudo** , crashes, you may wish to re-enable core dumps by
           setting “disable_coredump” to false in the _sudo.conf_(5) file as
           follows:
    
               Set disable_coredump false
    
           See the _sudo.conf_(5) manual for more information.
    


## ENVIRONMENT



           **sudo** , utilizes the following environment variables.  The security
           policy has control over the actual content of the _command_ 's
           environment.
    
           EDITOR           Default editor to use in **-e**(sudoedit) mode if
                            neither SUDO_EDITOR nor VISUAL is set.
    
           MAIL             Set to the mail spool of the target user when the
                            **-i** option is specified, or when _env_reset_ is
                            enabled in _sudoers_ (unless MAIL is present in the
                            _env_keep_ list).
    
           HOME             Set to the home directory of the target user when
                            the **-i** or **-H** options are specified, when the **-s**
                            option is specified and _set_home_ is set in
                            _sudoers_ , when _always_set_home_ is enabled in
                            _sudoers_ , or when _env_reset_ is enabled in _sudoers_
                            and HOME is not present in the _env_keep_ list.
    
           LOGNAME          Set to the login name of the target user when the
                            **-i** option is specified, when the _set_logname_
                            option is enabled in _sudoers_ , or when the
                            _env_reset_ option is enabled in _sudoers_ (unless
                            LOGNAME is present in the _env_keep_ list).
    
           PATH             May be overridden by the security policy.
    
           SHELL            Used to determine shell to run with **-s** option.
    
           SUDO_ASKPASS     Specifies the path to a helper program used to
                            read the password if no terminal is available or
                            if the **-A** option is specified.
    
           SUDO_COMMAND     Set to the _command_ run by sudo, including any
                            _arg_ s. The _arg_ s are truncated at 4096 characters
                            to prevent a potential execution error.
    
           SUDO_EDITOR      Default editor to use in **-e**(sudoedit) mode.
    
           SUDO_GID         Set to the group-ID of the user who invoked sudo.
    
           SUDO_HOME        Set to the home directory of the user who invoked
                            sudo.
    
           SUDO_PROMPT      Used as the default password prompt unless the **-p**
                            option was specified.
    
           SUDO_PS1         If set, PS1 will be set to its value for the
                            program being run.
    
           SUDO_TTY         Set to the terminal device of the user who
                            invoked sudo, if one is present.
    
           SUDO_UID         Set to the user-ID of the user who invoked sudo.
    
           SUDO_USER        Set to the login name of the user who invoked
                            sudo.
    
           USER             Set to the same value as LOGNAME, described
                            above.
    
           VISUAL           Default editor to use in **-e**(sudoedit) mode if
                            SUDO_EDITOR is not set.
    


## FILES



           _/etc/sudo.conf_            **sudo** , front-end configuration
    


## EXAMPLES



           The following examples assume a properly configured security
           policy.
    
           To get a file listing of an unreadable directory:
    
               $ sudo ls /usr/local/protected
    
           To list the home directory of user yaz on a machine where the file
           system holding ~yaz is not exported as root:
    
               $ sudo -u yaz ls ~yaz
    
           To edit the _index.html_ file as user www:
    
               $ sudoedit -u www ~www/htdocs/index.html
    
           To view system logs only accessible to root and users in the adm
           group:
    
               $ sudo -g adm more /var/log/syslog
    
           To run an editor as jim with a different primary group:
    
               $ sudoedit -u jim -g audio ~jim/sound.txt
    
           To shut down a machine:
    
               $ sudo shutdown -r +15 "quick reboot"
    
           To make a usage listing of the directories in the /home partition.
           The _commands_ are run in a sub-shell to allow the ‘cd’ command and
           file redirection to work.
    
               $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
    


## DIAGNOSTICS



           Error messages produced by **sudo** , include:
    
           editing files in a writable directory is not permitted
               By default, **sudoedit** does not permit editing a file when any
               of the parent directories are writable by the invoking user.
               This avoids a race condition that could allow the user to
               overwrite an arbitrary file.  See the _sudoedit_checkdir_ option
               in _sudoers_(5) for more information.
    
           editing symbolic links is not permitted
               By default, **sudoedit** does not follow symbolic links when
               opening files.  See the _sudoedit_follow_ option in _sudoers_(5)
               for more information.
    
           effective uid is not 0, is sudo installed setuid root?
               **sudo** , was not run with root privileges.  The **sudo** , binary must
               be owned by the root user and have the set-user-ID bit set.
               Also, it must not be located on a file system mounted with the
               ‘nosuid’ option or on an NFS file system that maps uid 0 to an
               unprivileged uid.
    
           effective uid is not 0, is sudo on a file system with the 'nosuid'
           option set or an NFS file system without root privileges?
               **sudo** , was not run with root privileges.  The **sudo** , binary has
               the proper owner and permissions but it still did not run with
               root privileges.  The most common reason for this is that the
               file system the **sudo** , binary is located on is mounted with the
               ‘nosuid’ option or it is an NFS file system that maps uid 0 to
               an unprivileged uid.
    
           fatal error, unable to load plugins
               An error occurred while loading or initializing the plugins
               specified in _sudo.conf_(5).
    
           invalid environment variable name
               One or more environment variable names specified via the **-E**
               option contained an equal sign (‘=’).  The arguments to the **-E**
               option should be environment variable names without an
               associated value.
    
           no password was provided
               When **sudo** , tried to read the password, it did not receive any
               characters.  This may happen if no terminal is available (or
               the **-S** option is specified) and the standard input has been
               redirected from _/dev/null_.
    
           a terminal is required to read the password
               **sudo** , needs to read the password but there is no mechanism
               available for it to do so.  Remote commands run via _ssh_(1) do
               not have a terminal available by default; passing the **-t**
               option to _ssh_(1) will cause it to allocate a terminal which
               should allow **sudo** , to read the password.  To allow **sudo** , to
               run local commands without a terminal, the **-S** option can be
               used to read a password from the standard input, or an askpass
               helper can be configured via either the _sudo.conf_(5) file or
               by setting the SUDO_ASKPASS environment variable.
    
           no writable temporary directory found
               **sudoedit** was unable to find a usable temporary directory in
               which to store its intermediate files.
    
           The “no new privileges” flag is set, which prevents sudo from
           running as root.
               **sudo** , was run by a process that has the Linux “no new
               privileges” flag is set.  This causes the set-user-ID bit to
               be ignored when running an executable, which will prevent
               **sudo** , from functioning.  The most likely cause for this is
               running **sudo** , within a container that sets this flag.  Check
               the documentation to see if it is possible to configure the
               container such that the flag is not set.
    
           sudo must be owned by uid 0 and have the setuid bit set
               **sudo** , was not run with root privileges.  The **sudo** , binary does
               not have the correct owner or permissions.  It must be owned
               by the root user and have the set-user-ID bit set.
    
           sudoedit is not supported on this platform
               It is only possible to run **sudoedit** on systems that support
               setting the effective user-ID.
    
           timed out reading password
               The user did not enter a password before the password timeout
               (5 minutes by default) expired.
    
           you do not exist in the passwd database
               Your user-ID does not appear in the system passwd database.
    
           you may not specify environment variables in edit mode
               It is only possible to specify environment variables when
               running a _command_.  When editing a file, the editor is run
               with the user's environment unmodified.
    


## CAVEATS



           There is no easy way to prevent a user from gaining a root shell
           if that user is allowed to run arbitrary _commands_ via **sudo** ,.
           Also, many programs (such as editors) allow the user to run
           _command_ s via shell escapes, thus avoiding **sudo** 's checks.  However,
           on most systems it is possible to prevent shell escapes with the
           _sudoers_(5) plugin's _noexec_ functionality.
    
           It is not meaningful to run the ‘cd’ _command_ directly via sudo,
           e.g.,
    
               $ sudo cd /usr/local/protected
    
           since when the _command_ exits the parent process (your shell) will
           still be the same.  The **-D** option can be used to run a _command_ in
           a specific _directory_.
    
           Running shell scripts via **sudo** , can expose the same kernel bugs
           that make set-user-ID shell scripts unsafe on some operating
           systems (if your OS has a /dev/fd/ directory, set-user-ID shell
           scripts are generally safe).
    


## BUGS



           If you believe you have found a bug in **sudo** ,, you can either file
           a bug report in the sudo bug database, https://bugzilla.sudo.ws/,
           or open an issue at https://github.com/sudo-project/sudo/issues.
           If you would prefer to use email, messages may be sent to the
           sudo-workers mailing list,
           https://www.sudo.ws/mailman/listinfo/sudo-workers (public) or
           <sudo@sudo.ws> (private).
    
           Please do not report security vulnerabilities through public
           GitHub issues, Bugzilla or mailing lists.  Instead, report them
           via email to <Todd.Miller@sudo.ws>.  You may encrypt your message
           with PGP if you would like, using the key found at
           https://www.sudo.ws/dist/PGPKEYS.
    


## SUPPORT



           Limited free support is available via the sudo-users mailing list,
           see https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe
           or search the archives.
    


## DISCLAIMER



           **sudo** , is provided “AS IS” and any express or implied warranties,
           including, but not limited to, the implied warranties of
           merchantability and fitness for a particular purpose are
           disclaimed.  See the LICENSE.md file distributed with **sudo** , or
           https://www.sudo.ws/about/license/ for complete details.
    


* * *