SUDO(8)

📦
version 0.2.15 · 3 versions
, in arch rolling

👑 SUDO(8) — the sudo / sudoedit glow-up ✨

okay bestie, this is the sudo(8) page from the sudo-rs manual, and we're gonna get through it together, no cap 💖

🌸 NAME 🌸

sudo, sudoedit — literally just execute a command as another user, that's the whole vibe 🫶

🎀 SYNOPSIS 🎀

here's the shape of it, copy these exactly because flags are not a vibe you freestyle:

sudo -h | -K | -k | -V
sudo [-u user] [-g group] [-D directory] [-BbknS] [-i | -s] [VAR=value]
[<command>]
sudo -v [-BknS] [-u user] [-g group]
sudo -l [-BknS] [-U user] [-u user] [-g group] [command [arg ...]]
sudo -e [-BknS] [-u user] [-g group] file ...
sudoedit [-BknS] [-u user] [-g group] file ...

🦋 DESCRIPTION 🦋

so sudo lets a user who's actually permitted to run a command as another user (root, for example 👑). and who's permitted? that's decided by a security policy that lives in /etc/sudoers — peep sudoers(5) for the deets.

sudo-rs is a safety-oriented, memory-safe re-implementation of the original sudo by Todd Miller. yes, the remake actually ate 💅

when a command runs, a session record gets stored for that specific session, so you can run more commands after without re-authenticating every single time 😭 the timeout for session records is specifiable in the policy.

some care is taken to pass signals received by sudo-rs down to the child process, even if that process is running in its own pseudo terminal. signals stay in the group chat, fr fr.

⚠️ okay this part is important: on systems where sudo is the primary method of gaining superuser privileges, it is imperative to avoid syntax errors in the /etc/sudoers file. change that file using the visudo(8) utility, which makes sure no syntax errors sneak in. do not rawdog your sudoers file, bestie, I'm begging 🙈

✨ OPTIONS ✨

every single one, no skipping, we respect the lore:

  • -A, --askpass — normally, if sudo needs a password, it reads it from the user's terminal. with -A (askpass) a (possibly graphical 👀) helper program gets executed to read the user's password and spit it out to standard output. if the SUDO_ASKPASS environment variable is set, it specifies the path to that helper program. and if no askpass program is available at all, sudo exits with an error 💀
  • -B, --bell — rings the bell 🔔 as part of the password prompt, when a terminal is present.
  • -b, --background — runs the given command in the background. heads up: you can't use shell job control to manipulate background processes started by sudo-rs, and most interactive commands will fail to work properly in background mode 😬
  • -D directory, --chdir=directory — runs the command in the specified directory instead of the current working directory. the security policy may return an error if the user doesn't have permission to specify the working directory.
  • -g group, --group=group — uses this group as the primary group, instead of the primary group specified in the password database for the target user.
  • -h, --help — shows a help message 🫶
  • -i, --login — runs the shell specified by the target user's password database entry as a login shell. that means login-specific resource files like .profile, .bash_profile or .login get read by the shell. if a command is specified, it's passed to the shell using the -c option.
  • -K, --remove-timestamp — removes every cached session record for the user, regardless of where the command is executed 😳 next time sudo-rs runs, authentication happens if the policy requires it. no password needed to run this one.
  • -k, --reset-timestamp — with no command, it invalidates the user's session record for the current session. next time sudo-rs runs, authentication happens if the policy requires it. when used together with a command or an option that may require a password, this option makes sudo-rs ignore the user's session record — so authentication happens if the policy requires it. and when it's used with a command, no invalidation of existing session records takes place.
  • -n, --non-interactive — avoids prompting the user for input of any kind. if any input is required for the command to run, sudo-rs shows an error message and dips. bye 👋
  • -p, --prompt=prompt — uses a custom authentication prompt with optional escape sequences. these percent (%) escape sequences are supported:
    • %H — expanded to the local host name
    • %h — expanded to the local host name without the domain name
    • %p — expanded to the name of the user whose password is being requested (this respects the rootpw, targetpw flags)
    • %U — expanded to the login name of the user the command will be run as (defaults to root unless the -u option is also specified)
    • %u — expanded to the invoking user's login name
    • %% — two consecutive % characters are collapsed into a single % character

the custom prompt overrides the default prompt, or the one specified by the SUDO_PROMPT environment variable. no prompt will suppress the prompt provided by PAM, unless the requested prompt is empty ("").

  • -S, --stdin — reads from standard input instead of using the terminal device.
  • -s, --shell — runs the shell specified by the SHELL environment variable. if no shell was specified, the shell from the user's password database entry is used instead. if a command is specified, it's passed to the shell using the -c option.
  • --preserve-env=list — tells the security policy that the user wants to add the comma-separated list of environment variables to those preserved from the user's environment. the security policy may return an error if the user doesn't have permission to preserve the environment. this option may be specified multiple times 👀
  • -e, --edit, sudoedit — edits one or more files instead of running a command. instead of a path name, the string sudoedit is used when consulting the security policy. if the user is authorized by the policy, here's the little ritual that happens:
    1. temporary copies are made of the files to be edited, with the owner set to the invoking user.
    2. the editor specified by the policy is run to edit the temporary files. the sudoers policy uses the SUDO_EDITOR, VISUAL and EDITOR environment variables (in that order). if none of SUDO_EDITOR, VISUAL or EDITOR are set, the first program listed in the editor sudoers(5) option is used.
    3. if they've been modified, the content of the temporary files is copied back to the originals, and the temporary versions are removed ✨

to help prevent the editing of unauthorized files, these restrictions are enforced (unless the user is root 👑):

  • symbolic links may not be edited.
  • if any component of the path leading to the file is writable by the invoking user, the file may not be edited.
  • users are never allowed to edit device special files.

if the specified file doesn't exist, it gets created. and unlike most commands run by sudo, the editor runs with the invoking user's environment unmodified. also! if the temporary file becomes empty after editing, the user gets prompted before it's installed. safety first, bestie 🎀

  • -u user, --user=user — runs the command as another user instead of the default (root).
  • -V, --version — displays the current version of sudo-rs 🫶
  • -v, --validate — updates the session record for the current session, authenticating the user if necessary.
  • -l, --list — lists user's privileges or checks a specific command; use it twice for the longer format 👀
  • -U, --other-user=user — used in list mode, displays privileges for another user.
  • -- — indicates the end of the sudo-rs options and the start of the command. iconic little separator, we love her 💅

environment variables to be set for the command may be passed on the command line in the form of VAR=value. variables passed on the command line are subject to restrictions imposed by the security policy. they're subject to the same restrictions as normal environment variables, with one important exception: if the command to be run has the SETENV tag set, or the command matched is ALL, the user may set variables that would otherwise be forbidden 🤯 see sudoers(5) for more information.

🌈 SEE ALSO 🌈

su(1), sudoers(5), visudo(8) — go read your friends, they're all baddies 🫶

💖 and that's the page! this was sudo-rs, version 0.2.15, serving SUDO(8) realness. go forth and sudo responsibly, bestie — and remember: visudo, always visudo 💅✨
📦 where this page comes from