SUDOERS_TIMESTAMP(5) | File Formats and Configurations | SUDOERS_TIMESTAMP(5) |
sudoers_timestamp
—
sudoers
plugin uses per-user time stamp files for
credential caching. Once a user has been authenticated, they may use
sudo
without a password for a short period of time
(5
minutes unless overridden by the
timestamp_timeout option). By default,
sudoers
uses a separate record for each terminal,
which means that a user's login sessions are authenticated separately. The
timestamp_type option can be used to select the type of time
stamp record sudoers
will use.
A multi-record time stamp file format was introduced in
sudo
1.8.10 that uses a single file per user.
Previously, a separate file was used for each user and terminal combination
unless tty-based time stamps were disabled. The new format is extensible and
records of multiple types and versions may coexist within the same file.
All records, regardless of type or version, begin with a 16-bit version number and a 16-bit record size.
Time stamp records have the following structure:
/* Time stamp entry types */ #define TS_GLOBAL 0x01 /* not restricted by tty or ppid */ #define TS_TTY 0x02 /* restricted by tty */ #define TS_PPID 0x03 /* restricted by ppid */ #define TS_LOCKEXCL 0x04 /* special lock record */ /* Time stamp flags */ #define TS_DISABLED 0x01 /* entry disabled */ #define TS_ANYUID 0x02 /* ignore uid, only valid in key */ struct timestamp_entry { unsigned short version; /* version number */ unsigned short size; /* entry size */ unsigned short type; /* TS_GLOBAL, TS_TTY, TS_PPID */ unsigned short flags; /* TS_DISABLED, TS_ANYUID */ uid_t auth_uid; /* uid to authenticate as */ pid_t sid; /* session ID associated with tty/ppid */ struct timespec start_time; /* session/ppid start time */ struct timespec ts; /* time stamp (CLOCK_MONOTONIC) */ union { dev_t ttydev; /* tty device number */ pid_t ppid; /* parent pid */ } u; };
The timestamp_entry struct fields are as follows:
TS_GLOBAL
,
TS_TTY
, or TS_PPID
.TS_DISABLED
, for records disabled via
sudo
-k
and
TS_ANYUID
, which is used only when matching
records.TS_TTY
.TS_TTY
or of the parent process for records of
type TS_PPID
. The start_time is
used to help prevent re-use of a time stamp record after a user has logged
out. Not all systems support a method to easily retrieve a process's start
time. The start_time field was added in
sudoers
version 1.8.22 for the second revision of
the timestamp_entry struct.sudoers
uses a monotonic timer that increments
even while the system is suspended. The value of ts is
updated each time a command is run via sudo
. If
the difference between ts and the current time is less
than the value of the timestamp_timeout option, no
password is required.TS_TTY
.TS_PPID
.sudoers
versions 1.8.10 through 1.8.14, the entire
time stamp file was locked for exclusive access when reading or writing to the
file. Starting in sudoers
1.8.15, individual records
are locked in the time stamp file instead of the entire file and the lock is
held for a longer period of time. This scheme is described below.
The first record in the time stamp file is of type
TS_LOCKEXCL
and is used as a lock
record to prevent more than one sudo
process from
adding a new record at the same time. Once the desired time stamp record has
been located or created (and locked), the
TS_LOCKEXCL
record is unlocked. The lock on the
individual time stamp record, however, is held until authentication is
complete. This allows sudoers
to avoid prompting for
a password multiple times when it is used more than once in a pipeline.
Records of type TS_GLOBAL
cannot be locked
for a long period of time since doing so would interfere with other
sudo
processes. Instead, a separate lock record is
used to prevent multiple sudo
processes using the
same terminal (or parent process ID) from prompting for a password as the
same time.
sudo
used a single zero-length file per user
and the file's modification time was used as the time stamp. Later versions of
sudo
added restrictions on the ownership of the time
stamp files and directory as well as checks on the validity of the time stamp
itself. Notable changes were introduced in the following
sudo
versions:
Support was added for the kernel-based tty time stamps available in OpenBSD which do not use an on-disk time stamp file.
sudo
over the years; this
version consists of code written primarily by:
See the CONTRIBUTORS.md file in the sudo
distribution (https://www.sudo.ws/about/contributors/) for an exhaustive
list of people who have contributed to sudo
.
sudo
, you can
submit a bug report at https://bugzilla.sudo.ws/
sudo
is provided “AS IS” and any express
or implied warranties, including, but not limited to, the implied warranties
of merchantability and fitness for a particular purpose are disclaimed. See
the LICENSE.md file distributed with sudo
or
https://www.sudo.ws/about/license/ for complete details.
February 16, 2022 | Sudo 1.9.11p3 |