Gentoo Sudo(ers) Guide

0.1 2005-01-01 About Sudo

Granting Permissions

The app-admin/sudo package allows the system administrator to grant permission to other users to execute one or more applications they would normally have no access to. Unlike using the setuid bit on these applications sudo gives a more fine-grained control on who can execute a certain command and when.

With sudo you can make a clear list who can execute a certain application. If you would set the setuid bit, any user would be able to run this application (or any user of a certain group, depending on the permissions used). You can (and probably even should) require the user to provide a password when he wants to execute the application and you can even fine-tune the permissions based on the location where the user is at: if he is logged on from the system itself or through SSH from a remote site.

Logging Activity

One additional advantage of sudo is that it can log any attempt (succesful or not) to run an application. This is very useful if you want to track who made that one fatal mistake that took you 10 hours to fix :)

Configuring Sudo

The sudo configuration is managed by the /etc/sudoers file. This file should never be edited through nano /etc/sudoers or vim /etc/sudoers or any other editor you might like. When you want to alter this file, you should use visudo.

This tool makes sure that no two system administrators are editing this file at the same time, preserves the permissions on the file and performs some syntax checking to make sure you make no fatal mistakes in the file.

About this Guide

This guide is meant as a quick introduction. The sudo package is a lot more powerful than what is described in this guide. It has special features for editing files as a different user (sudoedit), running from within a script (so it can background, read the password from standard in instead of the keyboard, ...), etc.

Sudoers Syntax

Basic Syntax

The most difficult part of sudo is the /etc/sudoers syntax. The basic syntax is like so:

user  host = commands

This syntax tells sudo that the user, identified by user and logged on through the system host can execute any of the commands listed in commands as the root user. A more real-life example might make this more clear: allow the user swift to execute emerge if he is logged on from the system (not through SSH):

swift  localhost = /usr/bin/emerge

You can extend the line to allow for several commands (instead of making a single entry for each command). For instance, to allow the same user to not only run emerge but also ebuild and emerge-webrsync as root:

swift  localhost = /usr/bin/emerge, /usr/bin/ebuild, /usr/sbin/emerge-webrsync

You can also specify a precise command and not only the tool itself. This is useful to restrict the use of a certain tool to a specified set of command options. The sudo tool allows for regular expressions to be used as well.

Let us put this to the test:

$ sudo emerge -uDN world

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

Password: (Enter the user password, not root!)

The password that sudo requires is the user his own password. This is to make sure that no terminal that you accidentally left open to others is abused for malicious purposes.

You should know that sudo does not alter the ${PATH} variable: any command you place after sudo is treated from your environment. If you want the user to run a tool in for instance /sbin he should provide the full path to sudo, like so:

$ sudo /usr/sbin/emerge-webrsync

Using Aliases

In larger environments having to enter all users over and over again (or hosts, or commands) can be a daunting task. To ease the administration of /etc/sudoers you can define aliases. The format to declare aliases is quite simple:

Host_Alias hostalias = hostname1, hostname2, ...
User_Alias useralias = user1, user2, ...
Cmnd_Alias cmndalias = command1, command2, ...

One alias that always works, for any position, is the ALL alias (to make a good distinction between aliases and non-aliases it is recommended to use -- gentoo-doc-cvs@gentoo.org mailing list