sudoers.5: Some remarks and a patch with editorial changes for this man page
Bjarni Ingi Gislason via sudo-workers <[email protected]> Thu, 20 Feb 2025 17:09:47 +0000
| Newsgroups | gmane.comp.tools.sudo.devel |
|---|---|
| Message-ID | <174007123359.3120.16875199277167405280.reportbug@kassi.invalid.is> |
--geunumyCLVEBywHZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Package: sudo
Version: 1.9.16p2-1
Severity: minor
Tags: patch
* What led up to the situation?
Checking for defects with a new version
test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=10 -ww -z < "man page"
[Use "groff -e ' $' -e '\\~$' <file>" to find obvious trailing spaces.]
["test-groff" is a script in the repository for "groff"; is not shipped]
(local copy and "troff" slightly changed by me).
[The fate of "test-nroff" was decided in groff bug #55941.]
* What was the outcome of this action?
troff:<stdin>:5779: warning: start index (-1) of substring out of range, set to 0
troff:<stdin>:5813: warning: start index (-1) of substring out of range, set to 0
* What outcome did you expect instead?
No output (no warnings).
-.-
General remarks and further material, if a diff-file exist, are in the
attachments.
-- System Information:
Debian Release: trixie/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.12-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages sudo depends on:
ii init-system-helpers 1.68
ii libapparmor1 3.1.7-2
ii libaudit1 1:4.0.2-2+b1
ii libc6 2.40-6
ii libpam-modules 1.7.0-3
ii libpam0g 1.7.0-3
ii libselinux1 3.7-3.1
ii libssl3t64 3.4.1-1
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
sudo recommends no packages.
sudo suggests no packages.
-- Configuration Files:
/etc/sudoers [Errno 13] Permission denied: '/etc/sudoers'
/etc/sudoers.d/README [Errno 13] Permission denied: '/etc/sudoers.d/README'
-- no debconf information
--geunumyCLVEBywHZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="chk_man.err.sudoers.5"
Input file is sudoers.5
Output from "mandoc -T lint sudoers.5": (shortened list)
Remove trailing space with: sed -e 's/ *$//'
1 no blank before trailing delimiter: Em log_stderr.
1 no blank before trailing delimiter: Em rlimit_as,
1 no blank before trailing delimiter: Em rlimit_core,
1 no blank before trailing delimiter: Em rlimit_cpu,
1 no blank before trailing delimiter: Em rlimit_data,
1 no blank before trailing delimiter: Em rlimit_fsize,
1 no blank before trailing delimiter: Em rlimit_locks,
1 no blank before trailing delimiter: Em rlimit_memlock,
1 no blank before trailing delimiter: Em rlimit_nofile,
1 no blank before trailing delimiter: Em rlimit_nproc,
1 no blank before trailing delimiter: Em rlimit_rss,
1 no blank before trailing delimiter: No 's)
1 operating system explicitly specified: Os Sudo (NetBSD)
1 referenced manual not found: Xr aa_change_profile 2
1 referenced manual not found: Xr exect 3
1 referenced manual not found: Xr execvP 3
1 referenced manual not found: Xr execveat 3
1 referenced manual not found: Xr fexecve 2 (2 times)
1 referenced manual not found: Xr getgrid 3
1 referenced manual not found: Xr sudoers.ldap 5 (2 times)
1 referenced manual not found: Xr truss 1
-.-.
Output from "test-groff -mandoc -t -ww -z sudoers.5": (shortened list)
2 start index (-1) of substring out of range, set to 0
-.-.
Change '-' (\-) to '\(en' (en-dash) for a (numeric) range.
GNU gnulib has recently (2023-06-18) updated its
"build_aux/update-copyright" to recognize "\(en" in man pages.
sudoers.5:783:NAME ::= [A-Z]([A-Z][0-9]_)*
sudoers.5:997:digest ::= [A-Fa-f0-9]+ |
sudoers.5:998: [A-Za-z0-9\e+/=]+
sudoers.5:2226:john ALL = /usr/bin/passwd ^[a-zA-Z0-9_]+$,\e
sudoers.5:4144:standard output, and standard error (file descriptors 0-2).
sudoers.5:6833:john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\e
sudoers.5:6834: /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
-.-.
Change two HYPHEN-MINUSES (code 0x2D) to an em-dash (\(em),
if one is intended.
" \(em " creates a too big gap in the text (in "troff").
An en-dash is usually surrounded by a space,
while an em-dash is used without spaces.
"man" (1 byte characters in input) transforms an en-dash (\(en) to one
HYPHEN-MINUS,
and an em-dash to two HYPHEN-MINUSES without considering the space
around it.
If "--" are two single "-"
(begin of an option or end of options)
then use "\-\-".
sudoers.5:6639:passwd username --expire
-.-.
Change -- in x--y to \(em (em-dash), or, if an
option, to \-\-
6639:passwd username --expire
-.-.
Change a HYPHEN-MINUS (code 0x2D) to a minus(-dash) (\-),
if it
is in front of a name for an option,
is a symbol for standard input,
is a single character used to indicate an option,
or is in the NAME section (man-pages(7)).
N.B. - (0x2D), processed as a UTF-8 file, is changed to a hyphen
(0x2010, groff \[u2010] or \[hy]) in the output.
1181:$ openssl dgst -sha224 /bin/ls
1187:$ openssl dgst -binary -sha224 /bin/ls | openssl base64
1457:$ sudo -u operator /bin/ls
1503:$ sudo -u operator /bin/ls
1504:$ sudo -u operator -g operator /bin/ls
1505:$ sudo -g operator /bin/ls
1521:$ sudo -g dialer /usr/bin/cu
1654:$ ppriv -l
1698:.Ql \-0500
1985:.Ql sudo \-l
1988:.Ql sudo \-v
2073:.St \-p1003.1 .
4040:.Li --with-logincap
4248:.Ql sudo \-v
4250:.Ql sudo \-k
5465:.Ql \-= ,
5490:.Ql \-= ,
5509:.Nm sudo Ns \-spawned
5516:.Ql \-= ,
6115:$ sh \-s < test.sh
6298:.Ql gunzip \-c ttyin | tr \&"\er\&" \&"\en\&"
6639:passwd username \-\-expire
6700:john ALPHA = /usr/bin/su [!\-]*, !/usr/bin/su *root*
6775: /sbin/mount \-o nosuid\e,nodev /dev/cd0a /CDROM
-.-.
Wrong distance between sentences in the input file.
Separate the sentences and subordinate clauses; each begins on a new
line. See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").
The best procedure is to always start a new sentence on a new line,
at least, if you are typing on a computer.
Remember coding: Only one command ("sentence") on each (logical) line.
E-mail: Easier to quote exactly the relevant lines.
Generally: Easier to edit the sentence.
Patches: Less unaffected text.
Search for two adjacent words is easier, when they belong to the same line,
and the same phrase.
The amount of space between sentences in the output can then be
controlled with the ".ss" request.
Mark a final abbreviation point as such by suffixing it with "\&".
Some sentences (etc.) do not begin on a new line.
Split (sometimes) lines after a punctuation mark; before a conjunction.
-.-.
Split lines longer than 80 characters into two or more lines.
Appropriate break points are the end of a sentence and a subordinate
clause; after punctuation marks.
Add "\:" to split the string for the output, "\<newline>" in the source.
Line 1333, length 114
.ie \n(PS Option_Spec ::= (SELinux_Spec | Solaris_Priv_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec)
Line 1334, length 88
.el Option_Spec ::= (SELinux_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec)
Line 1338, length 115
.ie \n(PS Option_Spec ::= (AppArmor_Spec | Solaris_Priv_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec)
Line 1339, length 89
.el Option_Spec ::= (AppArmor_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec)
Line 1342, length 99
.ie \n(PS Option_Spec ::= (Solaris_Priv_Spec | Date_Spec | Timeout_Spec | Chdir_Spec | Chroot_Spec)
Line 6028, length 83
.Bl -column "standard output" "log_output" "command output displayed to the screen"
-.-.
Put a parenthetical sentence, phrase on a separate line,
if not part of a code.
See man-pages(7), item "semantic newline".
Not considered in a patch, too many lines.
[List of affected lines removed]
-.-
4178:Values larger than 2176782336 (which corresponds to the
4181:will be silently truncated to 2176782336.
4182:The default value is 2176782336.
-.-.
Output from "test-groff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=10 -ww -z ":
troff:<stdin>:5779: warning: start index (-1) of substring out of range, set to 0
troff:<stdin>:5813: warning: start index (-1) of substring out of range, set to 0
-.-.
Generally:
Split (sometimes) lines after a punctuation mark; before a conjunction.
--geunumyCLVEBywHZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="sudoers.5.diff"
--- sudoers.5 2025-02-16 02:26:37.767649722 +0000
+++ sudoers.5.new 2025-02-20 05:43:57.752823008 +0000
@@ -191,7 +191,7 @@ when
requires
authentication, it validates the invoking user's credentials, not
the target user's (or
-.Sy root Ns No 's)
+.Sy root Ns No 's )
credentials.
This can be changed via
the
@@ -657,16 +657,16 @@ Resource limits may also be set in the
.Em sudoers
file itself, in which case they override those set by the system.
See the
-.Em rlimit_as,
-.Em rlimit_core,
-.Em rlimit_cpu,
-.Em rlimit_data,
-.Em rlimit_fsize,
-.Em rlimit_locks,
-.Em rlimit_memlock,
-.Em rlimit_nofile,
-.Em rlimit_nproc,
-.Em rlimit_rss,
+.Em rlimit_as ,
+.Em rlimit_core ,
+.Em rlimit_cpu ,
+.Em rlimit_data ,
+.Em rlimit_fsize ,
+.Em rlimit_locks ,
+.Em rlimit_memlock ,
+.Em rlimit_nofile ,
+.Em rlimit_nproc ,
+.Em rlimit_rss ,
.Em rlimit_stack
options described below.
Resource limits in
@@ -780,7 +780,7 @@ Cmnd_Alias ::= NAME
Cmnd_Alias_Spec ::= Cmnd_Alias '=' Cmnd_List
-NAME ::= [A-Z]([A-Z][0-9]_)*
+NAME ::= [A\(enZ]([A\(enZ][0\(en9]_)*
.Ed
.Pp
Each
@@ -994,8 +994,8 @@ Also, the host name
will only match if that is the actual host name, which is usually
only the case for non-networked systems.
.Bd -literal
-digest ::= [A-Fa-f0-9]+ |
- [A-Za-z0-9\e+/=]+
+digest ::= [A\(enFa\(enf0\(en9]+ |
+ [A\(enZa\(enz0\(en9\e+/=]+
Digest_Spec ::= "sha224" ':' digest |
"sha256" ':' digest |
@@ -2223,7 +2223,7 @@ on any host but is not allowed to change
password.
This kind of rule is impossible to express safely using wildcards.
.Bd -literal -offset 4n
-john ALL = /usr/bin/passwd ^[a-zA-Z0-9_]+$,\e
+john ALL = /usr/bin/passwd ^[a\(enzA\(enZ0\(en9_]+$,\e
!/usr/bin/passwd root
.Ed
.Pp
@@ -4037,7 +4037,7 @@ if one exists.
Only available if
.Nm sudo
is configured with the
-.Li --with-logincap
+.Li \-\-with-logincap
option.
This flag is
.Em off
@@ -4141,7 +4141,7 @@ by default.
Before it executes a command,
.Nm sudo
will close all open file descriptors other than standard input,
-standard output, and standard error (file descriptors 0-2).
+standard output, and standard error (file descriptors 0\(en2).
The
.Em closefrom
option can be used to specify a different file descriptor at which
@@ -4175,11 +4175,11 @@ While the value substituted for
is in base 36,
.Em maxseq
itself should be expressed in decimal.
-Values larger than 2176782336 (which corresponds to the
+Values larger than 2,176,782,336 (which corresponds to the
base 36 sequence number
.Dq ZZZZZZ )
-will be silently truncated to 2176782336.
-The default value is 2176782336.
+will be silently truncated to 2,176,782,336.
+The default value is 2,176,782,336.
.Pp
Once the local sequence number reaches the value of
.Em maxseq ,
@@ -4871,7 +4871,7 @@ groups runs
Only available if
.Nm sudo
is configured with the
-.Li --enable-admin-flag
+.Li \-\-enable-admin-flag
option.
The default value is
.Pa ~/.sudo_as_admin_successful .
@@ -5776,7 +5776,7 @@ locale.
If the user is not allowed to run the command, the reason for the denial
will follow the user name.
Possible reasons include:
-.Bl -tag -width 4
+.Bl -tag -width 4\" without unit!
.It user NOT in sudoers
The user is not listed in the
.Em sudoers
@@ -5810,7 +5810,7 @@ If an error occurs,
will log a message and, in most cases, send a message to the
administrator via email.
Possible errors include:
-.Bl -tag -width 4
+.Bl -tag -width 4\" without an unit!
.It parse error in /etc/sudoers near line N
.Nm
encountered an error when parsing the specified file.
@@ -6171,7 +6171,7 @@ flag or the
command tag will enable
.Em log_stdout
and
-.Em log_stderr.
+.Em log_stderr .
Careful ordering of rules may be necessary to achieve the results
that you expect.
.Ss I/O log format
@@ -6636,7 +6636,7 @@ options to
may be specified after the user argument.
As a result, this rule will also allow:
.Bd -literal -offset 4n
-passwd username --expire
+passwd username \-\-expire
.Ed
.Pp
which may not be desirable.
@@ -6830,8 +6830,8 @@ For example, given the following
.Em sudoers
file entry:
.Bd -literal
-john ALL = /usr/bin/passwd [a-zA-Z0-9]*, /usr/bin/chsh [a-zA-Z0-9]*,\e
- /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
+john ALL = /usr/bin/passwd [a\(enzA\(enZ0\(en9]*, /usr/bin/chsh [a\(enzA\(enZ0\(en9]*,\e
+ /usr/bin/chfn [a\(enzA\(enZ0\(en9]*, !/usr/bin/* root
.Ed
.Pp
User
--geunumyCLVEBywHZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="general.bugs"
Any program (person), that produces man pages, should check the output
for defects by using (both groff and nroff)
[gn]roff -mandoc -t -ww -b -z -K utf8 <man page>
The same goes for man pages that are used as an input.
For a style guide use
mandoc -T lint
-.-
Any "autogenerator" should check its products with the above mentioned
'groff', 'mandoc', and additionally with 'nroff ...'.
It should also check its input files for too long (> 80) lines.
This is just a simple quality control measure.
The "autogenerator" may have to be corrected to get a better man page,
the source file may, and any additional file may.
Common defects:
Not removing trailing spaces (in in- and output).
The reason for these trailing spaces should be found and eliminated.
"git" has a "tool" to point out whitespace,
see for example "git-apply(1)" and git-config(1)")
Not beginning each input sentence on a new line.
Line length and patch size should thus be reduced.
The script "reportbug" uses 'quoted-printable' encoding when a line is
longer than 1024 characters in an 'ascii' file.
See man-pages(7), item "semantic newline".
-.-
The difference between the formatted output of the original and patched file
can be seen with:
nroff -mandoc <file1> > <out1>
nroff -mandoc <file2> > <out2>
diff -d -u <out1> <out2>
and for groff, using
\"printf '%s\n%s\n' '.kern 0' '.ss 12 0' | groff -mandoc -Z - \"
instead of 'nroff -mandoc'
Add the option '-t', if the file contains a table.
Read the output from 'diff -d -u ...' with 'less -R' or similar.
-.-.
If 'man' (man-db) is used to check the manual for warnings,
the following must be set:
The option \"-warnings=w\"
The environmental variable:
export MAN_KEEP_STDERR=yes (or any non-empty value)
or
(produce only warnings):
export MANROFFOPT=\"-ww -b -z\"
export MAN_KEEP_STDERR=yes (or any non-empty value)
-.-
--geunumyCLVEBywHZ
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers
--geunumyCLVEBywHZ--