Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What does each ALL mean? I understand that the whole line indicates that the admin group members get admininstartive privileges, but would like to know more info about the position of the ALLS and if they each refer to a different set of permissions or something like that?

$sudo cat /etc/sudoers
...
# User privilege Information
root ALL=(ALL) ALL
#...
%sudo ALL=(ALL) ALL
#
#includedir /etc/sudoers.d

#Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
#

If it matters: OS: Ubuntu : 10.4

share|improve this question

1 Answer 1

up vote 6 down vote accepted

There is a manual page for sudoers(5).

Basically:

  • %admin – the group named "admin" (% prefix)
  • ALL= – on all hosts (if you distribute the same sudoers file to many computers)
  • (ALL) – as any target user
  • ALL – can run any command

A more restricted example would be:

%mailadmin   snow,rain=(root) /usr/sbin/postfix, /usr/sbin/postsuper, /usr/bin/doveadm
nobody       ALL=(root) NOPASSWD: /usr/sbin/rndc reload

In this case, the group mailadmin is allowed to run mail server control tools as user root on hosts named "snow" and "rain". The user nobody is allowed to run rndc reload as root, on all hosts, without being asked for any password. (Normally sudo asks for the invoker's own password.)

share|improve this answer
1  
What about the extra "ALL" after the ":" in "ALL=(ALL:ALL) ALL"? –  colan May 11 '12 at 3:37
1  
@colan: List of allowed groups for switching with the -g option. It's under "User Specification" in the manpage. –  grawity May 11 '12 at 4:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.