diff -up ./doc/sudoers.cat.manpage ./doc/sudoers.cat --- ./doc/sudoers.cat.manpage 2017-09-11 15:16:47.443869930 +0200 +++ ./doc/sudoers.cat 2017-09-11 15:42:15.140500826 +0200 @@ -1088,13 +1088,19 @@ SSUUDDOOEERRSS OOPPTTIIOONN connected to the user's tty, due to I/O redirection or because the command is part of a pipeline, that input is also captured and stored in a separate log file. - For more information, see the _I_/_O _L_O_G _F_I_L_E_S section. - This flag is _o_f_f by default. + Anything sent to the standard input will be consumed, + regardless of whether or not the command run via ssuuddoo + is actually reading the standard input. This may have + unexpected results when using ssuuddoo in a shell script + that expects to process the standard input. For more + information about I/O logging, see the _I_/_O _L_O_G _F_I_L_E_S + section. This flag is _o_f_f by default. log_output If set, ssuuddoo will run the command in a pseudo-tty and log all output that is sent to the screen, similar to - the script(1) command. For more information, see the - _I_/_O _L_O_G _F_I_L_E_S section. This flag is _o_f_f by default. + the script(1) command. For more information about I/O + logging, see the _I_/_O _L_O_G _F_I_L_E_S section. This flag is + _o_f_f by default. log_year If set, the four-digit year will be logged in the (non- syslog) ssuuddoo log file. This flag is _o_f_f by default. @@ -1396,13 +1402,18 @@ SSUUDDOOEERRSS OOPPTTIIOONN not needed, this option can be disabled to reduce the load on the LDAP server. This flag is _o_n by default. - use_pty If set, ssuuddoo will run the command in a pseudo-pty even - if no I/O logging is being gone. A malicious program - run under ssuuddoo could conceivably fork a background - process that retains to the user's terminal device - after the main program has finished executing. Use of - this option will make that impossible. This flag is - _o_f_f by default. + use_pty If set, and ssuuddoo is running in a terminal, the command + will be run in a pseudo-pty (even if no I/O logging is + being done). If the ssuuddoo process is not attached to a + terminal, _u_s_e___p_t_y has no effect. + + A malicious program run under ssuuddoo may be capable of + injecting injecting commands into the user's terminal + or running a background process that retains access to + the user's terminal device even after the main program + has finished executing. By running the command in a + separate pseudo-pty, this attack is no longer possible. + This flag is _o_f_f by default. utmp_runas If set, ssuuddoo will store the name of the runas user when updating the utmp (or utmpx) file. By default, ssuuddoo @@ -2135,11 +2146,11 @@ LLOOGG FFOORRMMAATT II//OO LLOOGG FFIILLEESS When I/O logging is enabled, ssuuddoo will run the command in a pseudo-tty - and log all user input and/or output. I/O is logged to the directory - specified by the _i_o_l_o_g___d_i_r option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a - unique session ID that is included in the ssuuddoo log line, prefixed with - ``TSID=''. The _i_o_l_o_g___f_i_l_e option may be used to control the format of - the session ID. + and log all user input and/or output, depending on which options are + are enabled. I/O is logged to the directory specified by the _i_o_l_o_g___d_i_r + option (_/_v_a_r_/_l_o_g_/_s_u_d_o_-_i_o by default) using a unique session ID that is + included in the ssuuddoo log line, prefixed with "TSID=". The _i_o_l_o_g___f_i_l_e + option may be used to control the format of the session ID. Each I/O log is stored in a separate directory that contains the following files: diff -up ./doc/sudoers.man.in.manpage ./doc/sudoers.man.in --- ./doc/sudoers.man.in.manpage 2017-09-11 15:16:47.444869925 +0200 +++ ./doc/sudoers.man.in 2017-09-11 15:16:47.456869864 +0200 @@ -2300,7 +2300,14 @@ will run the command in a pseudo-tty and If the standard input is not connected to the user's tty, due to I/O redirection or because the command is part of a pipeline, that input is also captured and stored in a separate log file. -For more information, see the +Anything sent to the standard input will be consumed, regardless of +whether or not the command run via +\fBsudo\fR +is actually reading the standard input. +This may have unexpected results when using +\fBsudo\fR +in a shell script that expects to process the standard input. +For more information about I/O logging, see the \fII/O LOG FILES\fR section. This flag is @@ -2314,7 +2321,7 @@ will run the command in a pseudo-tty and to the screen, similar to the script(1) command. -For more information, see the +For more information about I/O logging, see the \fII/O LOG FILES\fR section. This flag is @@ -2934,14 +2941,24 @@ This flag is by default. .TP 18n use_pty -If set, +If set, and \fBsudo\fR -will run the command in a pseudo-pty even if no I/O logging is being gone. +is running in a terminal, the command will be run in a pseudo-pty +(even if no I/O logging is being done). +If the +\fBsudo\fR +process is not attached to a terminal, +\fIuse_pty\fR +has no effect. +.sp A malicious program run under \fBsudo\fR -could conceivably fork a background process that retains to the user's -terminal device after the main program has finished executing. -Use of this option will make that impossible. +may be capable of injecting injecting commands into the user's +terminal or running a background process that retains access to the +user's terminal device even after the main program has finished +executing. +By running the command in a separate pseudo-pty, this attack is +no longer possible. This flag is \fIoff\fR by default. @@ -4281,7 +4298,8 @@ word wrap will be disabled. .SH "I/O LOG FILES" When I/O logging is enabled, \fBsudo\fR -will run the command in a pseudo-tty and log all user input and/or output. +will run the command in a pseudo-tty and log all user input and/or output, +depending on which options are enabled. I/O is logged to the directory specified by the \fIiolog_dir\fR option diff -up ./doc/sudoers.mdoc.in.manpage ./doc/sudoers.mdoc.in --- ./doc/sudoers.mdoc.in.manpage 2017-09-11 15:16:47.445869920 +0200 +++ ./doc/sudoers.mdoc.in 2017-09-11 15:16:47.456869864 +0200 @@ -2155,7 +2155,14 @@ will run the command in a pseudo-tty and If the standard input is not connected to the user's tty, due to I/O redirection or because the command is part of a pipeline, that input is also captured and stored in a separate log file. -For more information, see the +Anything sent to the standard input will be consumed, regardless of +whether or not the command run via +.Nm sudo +is actually reading the standard input. +This may have unexpected results when using +.Nm sudo +in a shell script that expects to process the standard input. +For more information about I/O logging, see the .Sx "I/O LOG FILES" section. This flag is @@ -2168,7 +2175,7 @@ will run the command in a pseudo-tty and to the screen, similar to the .Xr script 1 command. -For more information, see the +For more information about I/O logging, see the .Sx "I/O LOG FILES" section. This flag is @@ -2752,14 +2759,24 @@ This flag is .Em on by default. .It use_pty -If set, +If set, and .Nm sudo -will run the command in a pseudo-pty even if no I/O logging is being gone. +is running in a terminal, the command will be run in a pseudo-pty +(even if no I/O logging is being done). +If the +.Nm sudo +process is not attached to a terminal, +.Em use_pty +has no effect. +.Pp A malicious program run under .Nm sudo -could conceivably fork a background process that retains to the user's -terminal device after the main program has finished executing. -Use of this option will make that impossible. +may be capable of injecting injecting commands into the user's +terminal or running a background process that retains access to the +user's terminal device even after the main program has finished +executing. +By running the command in a separate pseudo-pty, this attack is +no longer possible. This flag is .Em off by default. @@ -3976,7 +3993,8 @@ word wrap will be disabled. .Sh I/O LOG FILES When I/O logging is enabled, .Nm sudo -will run the command in a pseudo-tty and log all user input and/or output. +will run the command in a pseudo-tty and log all user input and/or output, +depending on which options are enabled. I/O is logged to the directory specified by the .Em iolog_dir option