# cvtsudoers

## NAME



           **cvtsudoers** — convert between sudoers file formats
    


## SYNOPSIS



           **cvtsudoers**[**-ehMpV**] [**-b** _dn_] [**-c** _conf_file_] [**-d** _deftypes_] [**-f**
           _output_format_] [**-i** _input_format_] [**-I** _increment_] [**-l** _log_file_] [**-m**
           _filter_] [**-o** _output_file_] [**-O** _start_point_] [**-P** _padding_] [**-s**
           _sections_] [_input_file ..._]
    


## DESCRIPTION



           The **cvtsudoers** utility accepts one or more security policies in
           either _sudoers_ or LDIF format as input, and generates a single
           policy of the specified format as output.  The default input
           format is _sudoers_.  The default output format is LDIF.  It is only
           possible to convert a policy file that is syntactically correct.
    
           If no _input_file_ is specified, or if it is ‘-’, the policy is read
           from the standard input.  Input files may be optionally prefixed
           with a host name followed by a colon (‘:’) to make the policy
           rules specific to a host when merging multiple files.  By default,
           the result is written to the standard output.
    
           The options are as follows:
    
           **-b** _dn_ , **--base** =_dn_
                   The base DN (distinguished name) that will be used when
                   performing LDAP queries.  Typically this is of the form
                   “ou=SUDOers,dc=my-domain,dc=com” for the domain my-
                   domain.com.  If this option is not specified, the value of
                   the SUDOERS_BASE environment variable will be used
                   instead.  Only necessary when converting to LDIF format.
    
           **-c** _conf_file_ , **--config** =_conf_file_
                   Specify the path to the configuration file.  Defaults to
                   _/etc/cvtsudoers.conf_.
    
           **-d** _deftypes_ , **--defaults** =_deftypes_
                   Only convert _Defaults_ entries of the specified types.  One
                   or more _Defaults_ types may be specified, separated by a
                   comma (‘,’).  The supported types are:
    
                   all      All Defaults entries.
    
                   global   Global Defaults entries that are applied
                            regardless of user, runas, host, or command.
    
                   user     Per-user Defaults entries.
    
                   runas    Per-runas user Defaults entries.
    
                   host     Per-host Defaults entries.
    
                   command  Per-command Defaults entries.
    
                   See the **Defaults** section in _sudoers_(5) for more
                   information.
    
                   If the **-d** option is not specified, all _Defaults_ entries
                   will be converted.
    
           **-e** , **--expand-aliases**
                   Expand aliases in _input_file_.  Aliases are preserved by
                   default when the output _format_ is JSON or sudoers.
    
           **-f** _output_format_ , **--output-format** =_output_format_
                   Specify the output format (case-insensitive).  The
                   following formats are supported:
    
                   CSV      CSV (comma-separated value) files are often used
                            by spreadsheets and report generators.  See “CSV
                            output format” for more details.
    
                   JSON     JSON (JavaScript Object Notation) files are
                            usually easier for third-party applications to
                            consume than the traditional _sudoers_ format.  The
                            various values have explicit types which removes
                            much of the ambiguity of the _sudoers_ format.  See
                            “JSON output format” for more details.
    
                   LDIF     LDIF (LDAP Data Interchange Format) files can be
                            imported into an LDAP server for use with
                            _sudoers.ldap_(5).
    
                            Conversion to LDIF has the following limitations:
    
                            **•** Command, host, runas, and user-specific
                               Defaults lines cannot be translated as they
                               don't have an equivalent in the sudoers LDAP
                               schema.
    
                            **•** Command, host, runas, and user aliases are not
                               supported by the sudoers LDAP schema so they
                               are expanded during the conversion.
    
                   sudoers  Traditional sudoers format.  A new sudoers file
                            will be reconstructed from the parsed input file.
                            Comments are not preserved and data from any
                            include files will be output inline.
    
           **--group-file** =_file_
                   When the **-M** option is also specified, perform group
                   queries using _file_ instead of the system group database.
    
           **-h** , **--help**
                   Display a short help message to the standard output and
                   exit.
    
           **-i** _input_format_ , **--input-format** =_input_format_
                   Specify the input format.  The following formats are
                   supported:
    
                   LDIF     LDIF (LDAP Data Interchange Format) files can be
                            exported from an LDAP server to convert security
                            policies used by _sudoers.ldap_(5).  If a base DN
                            (distinguished name) is specified, only sudoRole
                            objects that match the base DN will be processed.
                            Not all sudoOptions specified in a sudoRole can
                            be translated from LDIF to sudoers format.
    
                   sudoers  Traditional sudoers format.  This is the default
                            input format.
    
           **-I** _increment_ , **--increment** =_increment_
                   When generating LDIF output, increment each sudoOrder
                   attribute by the specified number.  Defaults to an
                   increment of 1.
    
           **-l** _log_file_ , **--logfile** =_log_file_
                   Log conversion warnings to _log_file_ instead of to the
                   standard error.  This is particularly useful when merging
                   multiple _sudoers_ files, which can generate a large number
                   of warnings.
    
           **-m** _filter_ , **--match** =_filter_
                   Only output rules that match the specified _filter_.  A
                   _filter_ expression is made up of one or more **key =**_value_
                   pairs, separated by a comma (‘,’).  The **key** may be “cmnd”
                   (or “cmd”), “host”, “group”, or “user”.  For example, **user**
                   = _operator_ or **host** = _www_.  An upper-case _Cmnd_Alias_ ,
                   _Host_alias_ , or _User_Alias_ may be specified as the “cmnd”,
                   “host”, or “user”.
    
                   A matching _sudoers_ rule may also include users, groups,
                   and hosts that are not part of the _filter_.  This can
                   happen when a rule includes multiple users, groups, or
                   hosts.  To prune out any non-matching user, group, or host
                   from the rules, the **-p** option may be used.
    
                   By default, the password and group databases are not
                   consulted when matching against the filter so the users
                   and groups do not need to be present on the local system
                   (see the **-M** option).  Only aliases that are referenced by
                   the filtered policy rules will be displayed.
    
           **-M** , **--match-local**
                   When the **-m** option is also specified, use password and
                   group database information when matching users and groups
                   in the filter.  Only users and groups in the filter that
                   exist on the local system will match, and a user's groups
                   will automatically be added to the filter.  If the **-M** is
                   _not_ specified, users and groups in the filter do not need
                   to exist on the local system, but all groups used for
                   matching must be explicitly listed in the filter.
    
           **-o** _output_file_ , **--output** =_output_file_
                   Write the converted output to _output_file_.  If no
                   _output_file_ is specified, or if it is ‘-’, the converted
                   _sudoers_ policy will be written to the standard output.
    
           **-O** _start_point_ , **--order-start** =_start_point_
                   When generating LDIF output, use the number specified by
                   _start_point_ in the sudoOrder attribute of the first
                   sudoRole object.  Subsequent sudoRole object use a
                   sudoOrder value generated by adding an _increment_ , see the
                   **-I** option for details.  Defaults to a starting point of 1.
                   A starting point of 0 will disable the generation of
                   sudoOrder attributes in the resulting LDIF file.
    
           **--passwd-file** =_file_
                   When the **-M** option is also specified, perform passwd
                   queries using _file_ instead of the system passwd database.
    
           **-p** , **--prune-matches**
                   When the **-m** option is also specified, **cvtsudoers** will
                   prune out non-matching users, groups, and hosts from
                   matching entries.
    
           **-P** _padding_ , **--padding** =_padding_
                   When generating LDIF output, construct the initial
                   sudoOrder value by concatenating _order_start_ and
                   _increment_ , padding the _increment_ with zeros until it
                   consists of _padding_ digits.  For example, if _order_start_
                   is 1027, _padding_ is 3, and _increment_ is 1, the value of
                   sudoOrder for the first entry will be 1027000, followed by
                   1027001, 1027002, etc.  If the number of sudoRole entries
                   is larger than the padding would allow, **cvtsudoers** will
                   exit with an error.  By default, no padding is performed.
    
           **-s** _sections_ , **--suppress** =_sections_
                   Suppress the output of specific _sections_ of the security
                   policy.  One or more section names may be specified,
                   separated by a comma (‘,’).  The supported section name
                   are: **defaults** , **aliases** and **privileges**(which may be
                   shortened to **privs**).
    
           **-V** , **--version**
                   Print the **cvtsudoers** and _sudoers_ grammar versions and
                   exit.
    
       **Merging multiple files**
           When multiple input files are specified, **cvtsudoers** will attempt
           to merge them into a single policy file.  It is assumed that user
           and group names are consistent among the policy files to be
           merged.  For example, user “bob” on one host is the same as user
           “bob” on another host.
    
           When merging policy files, it is possible to prefix the input file
           name with a host name, separated by a colon (‘:’).  When the files
           are merged, the host name will be used to restrict the policy
           rules to that specific host where possible.
    
           The merging process is performed as follows:
    
           **•** Each input file is parsed into internal sudoers data
              structures.
    
           **•** Aliases are merged and renamed as necessary to avoid conflicts.
              In the event of a conflict, the first alias found is left as-is
              and subsequent aliases of the same name are renamed with a
              numeric suffix separated with a underscore (‘_’).  For example,
              if there are two different aliases named SERVERS, the first
              will be left as-is and the second will be renamed SERVERS_1.
              References to the renamed alias are also updated in the policy
              file.  Duplicate aliases (those with identical contents) are
              pruned.
    
           **•** Defaults settings are merged and duplicates are removed.  If
              there are conflicts in the Defaults settings, a warning is
              emitted for each conflict.  If a host name is specified with
              the input file, **cvtsudoers** will change the global Defaults
              settings in that file to be host-specific.  A warning is
              emitted for command, user, or runas-specific Defaults settings
              which cannot be made host-specific.
    
           **•** Per-user rules are merged and duplicates are removed.  If a
              host name is specified with the input file, **cvtsudoers** will
              change rules that specify a host name of **ALL** to the host name
              associated with the policy file being merged.  The merging of
              rules is currently fairly simplistic but will be improved in a
              later release.
    
           It is possible to merge policy files with differing formats.
    
       **The cvtsudoers.conf file**
           Options in the form “keyword = value” may also be specified in a
           configuration file, _/etc/cvtsudoers.conf_ by default.  The
           following keywords are recognized:
    
           **defaults =**_deftypes_
                 See the description of the **-d** command line option.
    
           **expand_aliases =**_yes_ | _no_
                 See the description of the **-e** command line option.
    
           **group_file =**_file_
                 See the description of the **--group-file** command line option.
    
           **input_format =**_ldif_ | _sudoers_
                 See the description of the **-i** command line option.
    
           **match =**_filter_
                 See the description of the **-m** command line option.
    
           **match_local =**_yes_ | _no_
                 See the description of the **-M** command line option.
    
           **order_increment =**_increment_
                 See the description of the **-I** command line option.
    
           **order_start =**_start_point_
                 See the description of the **-O** command line option.
    
           **output_format =**_csv_ | _json_ | _ldif_ | _sudoers_
                 See the description of the **-f** command line option.
    
           **padding =**_padding_
                 See the description of the **-P** command line option.
    
           **passwd_file =**_file_
                 See the description of the **--passwd-file** command line
                 option.
    
           **prune_matches =**_yes_ | _no_
                 See the description of the **-p** command line option.
    
           **sudoers_base =**_dn_
                 See the description of the **-b** command line option.
    
           **suppress =**_sections_
                 See the description of the **-s** command line option.
    
           Options on the command line will override values from the
           configuration file.
    
       **JSON output format**
           The _sudoers_ JSON format may contain any of the following top-level
           objects:
    
           Defaults
                 An array of objects, each containing an _Options_ array and an
                 optional _Binding_ array.
    
                 The _Options_ array consists of one or more objects, each
                 containing a “name:value” pair that corresponds to a _sudoers_
                 _Defaults_ setting.  _Options_ that operate on a list will also
                 include an _operation_ entry in the object, with a value of
                 “list_assign” for ‘=’, “list_add” for ‘+=’, or “list_remove”
                 for ‘-=’.
    
                 The optional _Binding_ array consists of one or more objects,
                 each containing a “name:value” pair and an optional _negated_
                 entry, which will negate any comparison performed with the
                 object.  If a _Binding_ is present, the setting will only take
                 effect if one of the specified _command_ , _hostname_ , _netgroup_ ,
                 _networkaddr_ , _nonunixgid_ , _nonunixgroup_ , _usergid_ , _usergroup_ ,
                 _userid_ , _username_ , or alias entries match.
    
                 For example, the following _sudoers_ entry:
    
                 Defaults@somehost set_home, env_keep += DISPLAY
    
                 converts to:
    
                 "Defaults": [
                     {
                         "Binding": [
                             { "hostname": "somehost" }
                         ],
                         "Options": [
                             { "set_home": true },
                             {
                                 "operation": "list_add",
                                 "env_keep": [
                                     "DISPLAY"
                                 ]
                             }
                         ]
                     }
                 ]
    
           User_Aliases
                 A JSON object containing one or more _sudoers User_Alias_
                 entries where each named alias has as its value an array
                 containing one or more objects.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be one of _netgroup_ , _nonunixgid_ , _nonunixgroup_ , _useralias_ ,
                 _usergid_ , _usergroup_ , _userid_ , or _username_.
    
                 For example, the following _sudoers_ entry:
    
                 User_Alias SYSADMIN = will, %wheel, +admin
    
                 converts to:
    
                 "User_Aliases": {
                     "SYSADMIN": [
                         { "username": "will" },
                         { "usergroup": "wheel" },
                         { "netgroup": "admin" }
                     ]
                 }
    
           Runas_Aliases
                 A JSON object containing one or more _sudoers Runas_Alias_
                 entries, where each named alias has as its value an array
                 containing one or more objects.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be one of _netgroup_ , _nonunixgid_ , _nonunixgroup_ ,
                 _runasalias_ , _usergid_ , _usergroup_ , _userid_ , or _username_.
    
                 For example, the following _sudoers_ entry:
    
                 Runas_Alias DB = oracle, sybase : OP = root, operator
    
                 converts to:
    
                 "Runas_Aliases": {
                     "DB": [
                         { "username": "oracle" },
                         { "username": "sybase" }
                     ],
                     "OP": [
                         { "username": "root" },
                         { "username": "operator" }
                     ]
                 }
    
           Host_Aliases
                 A JSON object containing one or more _sudoers Host_Alias_
                 entries where each named alias has as its value an array
                 containing one or more objects.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be one of _hostalias_ , _hostname_ , _netgroup_ , or _networkaddr_.
    
                 For example, the following _sudoers_ entries:
    
                 Host_Alias DORMNET = 128.138.243.0, 128.138.204.0/24
                 Host_Alias SERVERS = boulder, refuge
    
                 convert to:
    
                 "Host_Aliases": {
                     "DORMNET": [
                         { "networkaddr": "128.138.243.0" },
                         { "networkaddr": "128.138.204.0/24" }
                     ],
                     "SERVERS": [
                         { "hostname": "boulder" },
                         { "hostname": "refuge" }
                     ]
                 }
    
           Cmnd_Aliases
                 A JSON object containing one or more _sudoers Cmnd_Alias_
                 entries where each named alias has as its value an array
                 containing one or more objects.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be either another _cmndalias_ or a _command_.  For example,
                 the following _sudoers_ entries:
    
                 Cmnd_Alias SHELLS = /bin/bash, /bin/csh, /bin/sh, /bin/zsh
                 Cmnd_Alias VIPW = /usr/bin/chpass, /usr/bin/chfn, /usr/bin/chsh, \
                                   /usr/bin/passwd, /usr/sbin/vigr, /usr/sbin/vipw
    
                 convert to:
    
                 "Cmnd_Aliases": {
                     "SHELLS": [
                         { "command": "/bin/bash" },
                         { "command": "/bin/csh" },
                         { "command": "/bin/sh" },
                         { "command": "/bin/zsh" }
                     ],
                     "VIPW": [
                         { "command": "/usr/bin/chpass" },
                         { "command": "/usr/bin/chfn" },
                         { "command": "/usr/bin/chsh" },
                         { "command": "/usr/bin/passwd" },
                         { "command": "/usr/sbin/vigr" },
                         { "command": "/usr/sbin/vipw" }
                     ]
                 }
    
           User_Specs
                 A JSON array containing one or more objects, each
                 representing a _sudoers_ User_Spec.  Each object in the
                 _User_Specs_ array should contain a _User_List_ array, a
                 _Host_List_ array and a _Cmnd_Specs_ array.
    
                 A _User_List_ consists of one or more objects.  Each object
                 contains a “name:value” pair and an optional _negated_ entry,
                 which will negate any comparison performed with the object.
                 The name may be one of _netgroup_ , _nonunixgid_ , _nonunixgroup_ ,
                 _useralias_ , _usergid_ , _usergroup_ , _userid_ , or _username_.  If
                 _username_ is set to the special value **ALL** , it will match any
                 user.
    
                 A _Host_List_ consists of one or more objects.  Each object
                 contains a “name:value” pair and an optional _negated_ entry,
                 which will negate any comparison performed with the object.
                 The name may be one of _hostalias_ , _hostname_ , _netgroup_ , or
                 _networkaddr_.  If _hostname_ is set to the special value **ALL** ,
                 it will match any host.
    
                 The _Cmnd_Specs_ array consists of one or more JSON objects
                 describing a command that may be run.  Each _Cmnd_Specs_ is
                 made up of a _Commands_ array, an optional _runasusers_ array,
                 an optional _runasgroups_ array, and an optional _Options_
                 array.
    
                 The _Commands_ array consists of one or more objects
                 containing “name:value” pair elements.  The following names
                 and values are supported:
    
                 command  A string containing the command to run.  The
                          special value **ALL** it will match any command.
    
                 negated  A boolean value that, if true, will negate any
                          comparison performed with the object.
    
                 sha224   One or more SHA224 digests for the _command_ in
                          string form.  Multiple digests of the same type are
                          stored as an array.
    
                 sha256   One or more SHA256 digests for the _command_ in
                          string form.  Multiple digests of the same type are
                          stored as an array.
    
                 sha384   One or more SHA384 digests for the _command_ in
                          string form.  Multiple digests of the same type are
                          stored as an array.
    
                 sha512   One or more SHA512 digests for the _command_ in
                          string form.  Multiple digests of the same type are
                          stored as an array.
    
                 The _runasusers_ array consists of objects describing users
                 the command may be run as.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be one of _netgroup_ , _nonunixgid_ , _nonunixgroup_ ,
                 _runasalias_ , _usergid_ , _usergroup_ , _userid_ , or _username_.  If
                 _username_ is set to the special value **ALL** , it will match any
                 user.  If _username_ is set to the empty string “”, it will
                 match the invoking user.
    
                 The _runasgroups_ array consists of objects describing groups
                 the command may be run as.  Each object contains a
                 “name:value” pair and an optional _negated_ entry, which will
                 negate any comparison performed with the object.  The name
                 may be one of _runasalias_ , _usergid_ , or _usergroup_.  If
                 _usergroup_ is set to the special value **ALL** , it will match any
                 group.
    
                 The _Options_ array is of the same format as the one in the
                 _Defaults_ object.  Any _Tag_Spec_ entries in _sudoers_ are
                 converted to _Options_.  A user with “sudo ALL” privileges
                 will automatically have the _setenv_ option enabled to match
                 the implicit behavior provided by _sudoers_.
    
                 For example, the following _sudoers_ entry:
    
                 millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id
    
                 converts to:
    
                 "User_Specs": [
                     {
                         "User_List": [
                             { "username": "millert" }
                         ],
                         "Host_List": [
                             { "hostname": "ALL" }
                         ],
                         "Cmnd_Specs": [
                             {
                                 "runasusers": [
                                     { "username": "ALL" }
                                 ],
                                 "runasgroups": [
                                     { "usergroup": "ALL" }
                                 ],
                                 "Options": [
                                     { "authenticate": false },
                                     { "setenv": true }
                                 ],
                                 "Commands": [
                                     { "command": "ALL" },
                                     {
                                         "command": "/usr/bin/id",
                                         "negated": true
                                     }
                                 ]
                             }
                         ]
                     }
                 ]
    
       **CSV output format**
           CSV (comma-separated value) files are often used by spreadsheets
           and report generators.  For CSV output, **cvtsudoers** double quotes
           strings that contain commas.  For each literal double quote
           character present inside the string, two double quotes are output.
           This method of quoting commas is compatible with most spreadsheet
           programs.
    
           There are three possible sections in **cvtsudoers** 's CSV output, each
           separated by a blank line:
    
           defaults
                 This section includes any _Defaults_ settings in _sudoers_.  The
                 _defaults_ section begins with the following heading:
    
                       defaults_type,binding,name,operator,value
    
                 The fields are as follows:
    
                 defaults_type
                       The type of _Defaults_ setting; one of _defaults_ ,
                       _defaults_command_ , _defaults_host_ , _defaults_runas_ , or
                       _defaults_user_.
    
                 binding
                       For _defaults_command_ , _defaults_host_ , _defaults_runas_ ,
                       and _defaults_user_ this is the value that must match
                       for the setting to be applied.
    
                 name  The name of the _Defaults_ setting.
    
                 operator
                       The operator determines how the value is applied to
                       the setting.  It may be either ‘=’ (assignment), ‘+=’
                       (append), or ‘-=’ (remove).
    
                 value
                       The setting's value, usually a string or, for settings
                       used in a boolean context, _true_ or _false_.
    
           aliases
                 This section includes any _Cmnd_Alias Host_Alias_ ,
                 _Runas_Alias_ , or _User_Alias_ , entries from _sudoers_.  The
                 _aliases_ section begins with the following heading:
    
                       alias_type,alias_name,members
    
                 The fields are as follows:
    
                 alias_type
                       The type of alias; one of _Cmnd_Alias_ , _Host_Alias_ ,
                       _Runas_Alias_ , or _User_Alias_.
    
                 alias_name
                       The name of the alias; a string starting with an
                       upper-case letter that consists of upper-case letters,
                       digits, or underscores.
    
                 members
                       A comma-separated list of members belonging to the
                       alias.  Due to the use of commas, _members_ is
                       surrounded by double quotes if it contains more than
                       one member.
    
           rules
                 This section includes the _sudoers_ rules that grant
                 privileges.  The _rules_ section begins with the following
                 heading:
    
                       rule,user,host,runusers,rungroups,options,command
    
                 The fields are as follows:
    
                 rule  This field indicates a _sudoers rule_ entry.
    
                 user  The user the rule applies to.  This may also be a Unix
                       group (preceded by a ‘%’ character), a non-Unix group
                       (preceded by ‘%:’) or a netgroup (preceded by a ‘+’
                       character) or a _User_Alias_.  If set to the special
                       value **ALL** , it will match any user.
    
                 host  The host the rule applies to.  This may also be a
                       netgroup (preceded by a ‘+’ character) or a
                       _Host_Alias_.  If set to the special value **ALL** , it will
                       match any host.
    
                 runusers
                       An optional comma-separated list of users (or
                       _Runas_Alias_ es) the command may be run as.  If it
                       contains more than one member, the value is surrounded
                       by double quotes.  If set to the special value **ALL** , it
                       will match any user.  If empty, the root user is
                       assumed.
    
                 rungroups
                       An optional comma-separated list of groups (or
                       _Runas_Alias_ es) the command may be run as.  If it
                       contains more than one member, the value is surrounded
                       by double quotes.  If set to the special value **ALL** , it
                       will match any group.  If empty, the _runuser_ 's group
                       is used.
    
                 options
                       An optional list of _Defaults_ settings to apply to the
                       command.  Any _Tag_Spec_ entries in _sudoers_ are
                       converted to _options_.
    
                 commands
                       A list of commands, with optional arguments, that the
                       user is allowed to run.  If set to the special value
                       **ALL** , it will match any command.
    
                 For example, the following _sudoers_ entry:
    
                 millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id
    
                 converts to:
    
                 rule,millert,ALL,ALL,ALL,"!authenticate","ALL,!/usr/bin/id"
    


## FILES



           _/etc/cvtsudoers.conf_      default configuration for cvtsudoers
    


## EXAMPLES



           Convert _/etc/sudoers_ to LDIF (LDAP Data Interchange Format) where
           the _ldap.conf_ file uses a _sudoers_base_ of my-domain,dc=com,
           storing the result in _sudoers.ldif_ :
    
               $ cvtsudoers -b ou=SUDOers,dc=my-domain,dc=com -o sudoers.ldif \
                            /etc/sudoers
    
           Convert _/etc/sudoers_ to JSON format, storing the result in
           _sudoers.json_ :
    
               $ cvtsudoers -f json -o sudoers.json /etc/sudoers
    
           Parse _/etc/sudoers_ and display only rules that match user _ambrose_
           on host _hastur_ :
    
               $ cvtsudoers -f sudoers -m user=ambrose,host=hastur /etc/sudoers
    
           Same as above, but expand aliases and prune out any non-matching
           users and hosts from the expanded entries.
    
               $ cvtsudoers -ep -f sudoers -m user=ambrose,host=hastur /etc/sudoers
    
           Convert _sudoers.ldif_ from LDIF to traditional _sudoers_ format:
    
               $ cvtsudoers -i ldif -f sudoers -o sudoers.new sudoers.ldif
    
           Merge a global _sudoers_ file with two host-specific policy files
           from the hosts “xyzzy” and “plugh”:
    
               $ cvtsudoers -f sudoers -o sudoers.merged sudoers \
                   xyzzy:sudoers.xyzzy plugh:sudoers.plugh
    


## BUGS



           If you believe you have found a bug in **cvtsudoers** , you can either
           file a bug report in the sudo bug database,
           https://bugzilla.sudo.ws/, or open an issue at
           https://github.com/sudo-project/sudo/issues.  If you would prefer
           to use email, messages may be sent to the sudo-workers mailing
           list, https://www.sudo.ws/mailman/listinfo/sudo-workers (public)
           or <sudo@sudo.ws> (private).
    
           Please do not report security vulnerabilities through public
           GitHub issues, Bugzilla or mailing lists.  Instead, report them
           via email to <Todd.Miller@sudo.ws>.  You may encrypt your message
           with PGP if you would like, using the key found at
           https://www.sudo.ws/dist/PGPKEYS.
    


## SUPPORT



           Limited free support is available via the sudo-users mailing list,
           see https://www.sudo.ws/mailman/listinfo/sudo-users to subscribe
           or search the archives.
    


## DISCLAIMER



           **cvtsudoers** is provided “AS IS” and any express or implied
           warranties, including, but not limited to, the implied warranties
           of merchantability and fitness for a particular purpose are
           disclaimed.  See the LICENSE.md file distributed with **sudo** or
           https://www.sudo.ws/about/license/ for complete details.
    


* * *