If no input_file is specified, or if it is `-' , the policy is read from the standard input. Input files may be optionally prefixed with a host name followed by a colon (`:' ) to make the policy rules specific to a host when merging multiple files. By default, the result is written to the standard output.
The options are as follows:
See the Defaults section in sudoers(5) for more information.
If the -d option is not specified, all Defaults entries will be converted.
Conversion to LDIF has the following limitations:
A matching sudoers rule may also include users, groups, and hosts that are not part of the filter This can happen when a rule includes multiple users, groups, or hosts. To prune out any non-matching user, group, or host from the rules, the -p option may be used.
By default, the password and group databases are not consulted when matching against the filter so the users and groups do not need to be present on the local system (see the -M option). Only aliases that are referenced by the filtered policy rules will be displayed.
When merging policy files, it is possible to prefix the input file name with a host name, separated by a colon (`:' ) When the files are merged, the host name will be used to restrict the policy rules to that specific host where possible.
The merging process is performed as follows:
It is possible to merge policy files with differing formats.
Options on the command line will override values from the configuration file.
The Options array consists of one or more objects, each containing a ``name:value'' pair that corresponds to a sudoers Defaults setting. Options that operate on a list will also include an operation entry in the object, with a value of ``list_assign'' for `=' , ``list_add'' for `+=' , or ``list_remove'' for `-='
The optional Binding array consists of one or more objects, each containing a ``name:value'' pair and an optional negated entry, which will negate any comparison performed with the object. If a Binding is present, the setting will only take effect if one of the specified command hostname netgroup networkaddr nonunixgid nonunixgroup usergid usergroup userid username or alias entries match.
For example, the following sudoers entry:
Defaults@somehost set_home, env_keep += DISPLAY
converts to:
"Defaults": [ { "Binding": [ { "hostname": "somehost" } ], "Options": [ { "set_home": true }, { "operation": "list_add", "env_keep": [ "DISPLAY" ] } ] } ]
For example, the following sudoers entry:
User_Alias SYSADMIN = will, %wheel, +admin
converts to:
"User_Aliases": { "SYSADMIN": [ { "username": "will" }, { "usergroup": "wheel" }, { "netgroup": "admin" } ] }
For example, the following sudoers entry:
Runas_Alias DB = oracle, sybase : OP = root, operator
converts to:
"Runas_Aliases": { "DB": [ { "username": "oracle" }, { "username": "sybase" } ], "OP": [ { "username": "root" }, { "username": "operator" } ] }
For example, the following sudoers entries:
Host_Alias DORMNET = 128.138.243.0, 128.138.204.0/24 Host_Alias SERVERS = boulder, refuge
convert to:
"Host_Aliases": { "DORMNET": [ { "networkaddr": "128.138.243.0" }, { "networkaddr": "128.138.204.0/24" } ], "SERVERS": [ { "hostname": "boulder" }, { "hostname": "refuge" } ] }
Cmnd_Alias SHELLS = /bin/bash, /bin/csh, /bin/sh, /bin/zsh Cmnd_Alias VIPW = /usr/bin/chpass, /usr/bin/chfn, /usr/bin/chsh, \ /usr/bin/passwd, /usr/sbin/vigr, /usr/sbin/vipw
convert to:
"Cmnd_Aliases": { "SHELLS": [ { "command": "/bin/bash" }, { "command": "/bin/csh" }, { "command": "/bin/sh" }, { "command": "/bin/zsh" } ], "VIPW": [ { "command": "/usr/bin/chpass" }, { "command": "/usr/bin/chfn" }, { "command": "/usr/bin/chsh" }, { "command": "/usr/bin/passwd" }, { "command": "/usr/sbin/vigr" }, { "command": "/usr/sbin/vipw" } ] }
A User_List consists of one or more objects. Each object contains a ``name:value'' pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup nonunixgid nonunixgroup useralias usergid usergroup userid or username If username is set to the special value ALL it will match any user.
A Host_List consists of one or more objects. Each object contains a ``name:value'' pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias hostname netgroup or networkaddr If hostname is set to the special value ALL it will match any host.
The Cmnd_Specs array consists of one or more JSON objects describing a command that may be run. Each Cmnd_Specs is made up of a Commands array, an optional runasusers array, an optional runasgroups array, and an optional Options array.
The Commands array consists of one or more objects containing ``name:value'' pair elements. The following names and values are supported:
The runasusers array consists of objects describing users the command may be run as. Each object contains a ``name:value'' pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup nonunixgid nonunixgroup runasalias usergid usergroup userid or username If username is set to the special value ALL it will match any user. If username is set to the empty string ``'' it will match the invoking user.
The runasgroups array consists of objects describing groups the command may be run as. Each object contains a ``name:value'' pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of runasalias usergid or usergroup If usergroup is set to the special value ALL it will match any group.
The Options array is of the same format as the one in the Defaults object. Any Tag_Spec entries in sudoers are converted to Options A user with ``sudo ALL'' privileges will automatically have the setenv option enabled to match the implicit behavior provided by sudoers
For example, the following sudoers entry:
millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id
converts to:
"User_Specs": [ { "User_List": [ { "username": "millert" } ], "Host_List": [ { "hostname": "ALL" } ], "Cmnd_Specs": [ { "runasusers": [ { "username": "ALL" } ], "runasgroups": [ { "usergroup": "ALL" } ], "Options": [ { "authenticate": false }, { "setenv": true } ], "Commands": [ { "command": "ALL" }, { "command": "/usr/bin/id", "negated": true } ] } ] } ]
There are three possible sections in cvtsudoers 's CSV output, each separated by a blank line:
defaults_type,binding,name,operator,value
The fields are as follows:
alias_type,alias_name,members
The fields are as follows:
rule,user,host,runusers,rungroups,options,command
The fields are as follows:
For example, the following sudoers entry:
millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id
converts to:
rule,millert,ALL,ALL,ALL,"!authenticate","ALL,!/usr/bin/id"
$ cvtsudoers -b ou=SUDOers,dc=my-domain,dc=com -o sudoers.ldif \ /etc/sudoers
Convert /etc/sudoers to JSON format, storing the result in sudoers.json
$ cvtsudoers -f json -o sudoers.json /etc/sudoers
Parse /etc/sudoers and display only rules that match user ambrose on host hastur
$ cvtsudoers -f sudoers -m user=ambrose,host=hastur /etc/sudoers
Same as above, but expand aliases and prune out any non-matching users and hosts from the expanded entries.
$ cvtsudoers -ep -f sudoers -m user=ambrose,host=hastur /etc/sudoers
Convert sudoers.ldif from LDIF to traditional sudoers format:
$ cvtsudoers -i ldif -f sudoers -o sudoers.new sudoers.ldif
Merge a global sudoers file with two host-specific policy files from the hosts ``xyzzy'' and ``plugh''
$ cvtsudoers -f sudoers -o sudoers.merged sudoers \ xyzzy:sudoers.xyzzy plugh:sudoers.plugh
An Todd C. Miller
See the CONTRIBUTORS.md file in the sudo distribution (https://www.sudo.ws/about/contributors/) for an exhaustive list of people who have contributed to sudo