man:sudoers(5) EBNF issue

[e-kwsm]

sudo/docs/sudoers.man.in

Lines 692 to 718 in 8781032

	\(lqvalue\(rq
	Both the soft and hard resource limits are set to the same value.
	The special value
	\(lqinfinity\(rq
	can be used to indicate that the value is unlimited.
	.TP 8n
	\(lqsoft,hard\(rq
	Two comma-separated values.
	The soft limit is set to the first value and the hard limit is set
	to the second.
	Both values must either be enclosed in a set of double quotes,
	or the comma must be escaped with a backslash
	(\(oq\e\(cq).
	The special value
	\(lqinfinity\(rq
	may be used in place of either value.
	.TP 8n
	\(lqdefault\(rq
	The default resource limit for the user will be used.
	This may be a user-specific value (see above) or the value of the
	resource limit when
	\fBsudo\fR
	was invoked for systems that don't support per-user limits.
	.TP 8n
	\(lquser\(rq
	The invoking user's resource limits will be preserved when running
	the command.

Here, infinity, default, and user are literal, but they are not distinguishable from (arbitrary?) values 𝑣𝑎𝑙𝑢𝑒 and 𝑠𝑜𝑓𝑡,ℎ𝑎𝑟𝑑 viz. I would suggest

\(lq\fIvalue\fR\(rq

---

sudo/docs/sudoers.man.in

Line 809 in 8781032

NAME ::= [A\(enZ]([A\(enZ][0\(en9]_)*

sudo/docs/sudoers.man.in

Lines 1042 to 1043 in 8781032

	digest ::= [A\(enFa\(enf0\(en9]+ |
	[A\(enZa\(enz0\(en9\e+/=]+

Why en dash is used instead of hyphen?

---

sudo/docs/sudoers.man.in

Lines 1045 to 1048 in 8781032

	Digest_Spec ::= "sha224" ':' digest |
	"sha256" ':' digest |
	"sha384" ':' digest |
	"sha512" ':' digest

Why not 'sha224:' and so forth? or

Digest_Spec ::= algorithm ':' digest
algorithm   ::= 'sha224' | 'sha256' | 'sha384' | 'sha512'

---

sudo/docs/sudoers.man.in

Lines 1405 to 1423 in 8781032

	.if \n(SL \{\
	SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
	.\}
	.if \n(AA \{\
	AppArmor_Spec ::= 'APPARMOR_PROFILE=profile'
	.\}
	.if \n(PS \{\
	Solaris_Priv_Spec ::= ('PRIVS=privset' | 'LIMITPRIVS=privset')
	.\}
	Date_Spec ::= ('NOTBEFORE=timestamp' | 'NOTAFTER=timestamp')
	Timeout_Spec ::= 'TIMEOUT=timeout'
	Chdir_Spec ::= 'CWD=directory'
	Chroot_Spec ::= 'CHROOT=directory'

Here specs are quoted but shouldn't be something like

Date_Spec ::= ('NOTBEFORE=' | 'NOTAFTER=') timestamp
timestammp ::= yyyymmddHH MMSS? timezone?
timezone   ::= 'Z' | ('+' | '-') HHMM

[e-kwsm]

sudo/docs/sudoers.man.in

Line 1388 in 8781032

Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

This does not cover (:):

user ALL = (       ) ALL
user ALL = (   :ALL) ALL
user ALL = (ALL    ) ALL
user ALL = (ALL:ALL) ALL

# not covered by EBNF but valid
user ALL = (   :   ) ALL
# not covered by EBNF and invalid
# user ALL = (ALL:   ) ALL

[e-kwsm]

$ visudo -V
visudo version 1.9.17p2
visudo grammar version 50

sudo/docs/sudoers.man.in

Lines 954 to 965 in 8781032

	Runas_List ::= Runas_Member |
	Runas_Member ',' Runas_List
	Runas_Member ::= '!'* user name |
	'!'* #user-ID |
	'!'* %group |
	'!'* %#group-ID |
	'!'* %:nonunix_group |
	'!'* %:#nonunix_gid |
	'!'* +netgroup |
	'!'* Runas_Alias |
	'!'* ALL

sudo/docs/sudoers.man.in

Line 1388 in 8781032

Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

sudo/docs/sudoers.man.in

Lines 1447 to 1466 in 8781032

	.SS "Runas_Spec"
	A
	\fIRunas_Spec\fR
	determines the user and/or the group that a command
	may be run as.
	A fully-specified
	\fIRunas_Spec\fR
	consists of two
	\fIRunas_List\fRs
	(as defined above) separated by a colon
	(\(oq\&:\(cq)
	and enclosed in a set of parentheses.
	The first
	\fIRunas_List\fR
	indicates which users the command may be run as via the
	\fB\-u\fR
	option.
	The second defines a list of groups that may be specified via the
	\fB\-g\fR
	option (in addition to any of the target user's groups).

The first part: a group is not rejected:

$ visudo -c - << EOF
alice ALL = (%wheel : ALL) ALL
alice ALL = (%#1000 : ALL) ALL
EOF
stdin: parsed OK

From output of cvtsudoers -f json, this specifies users who belong to a group named wheel or GID of 1000, right?

The second part: a %-prefixed group as specified by the EBNF is rejected:

$ visudo -c - << EOF
alice ALL = (ALL :  wheel) ALL  # "wheel" is a group but not a user
alice ALL = (ALL : %wheel) ALL
alice ALL = (ALL :  #1000) ALL  # "#1000" is a GID but not a UID
alice ALL = (ALL : %#1000) ALL
EOF
stdin:2:20: syntax error
alice ALL = (ALL : %alice) ALL
                   ^~~~~~
stdin:4:20: syntax error
alice ALL = (ALL : %#1000) ALL
                   ^~~~~~

Namely, % is required to be removed.

[millert]

First of all, the *.man.in files are generated from *.mdoc.in so any changes need to be made in the .mdoc.in files.

The en dash is used in character ranges based on a bug report from a man page style checker. A regular hyphen is used in sudoers examples since an en dash would cause a syntax error.

You are correct that, e.g. %#1000 is not permitted in the group portion of a Runas_Spec. Fixing that would probably mean specifying a separate Runas_UserList and Runas_GroupList or something similar.

[e-kwsm]

The en dash is used in character ranges based on a bug report from a man page style checker. A regular hyphen is used in sudoers examples since an en dash would cause a syntax error.

Yeah, range should be specified by en dash, but I think BNF usually uses hyphen instead.