Tag_Spec
A command may have zero or more tags associated with it. There are ten possible tag values: NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV, NOSETENV, LOG_INPUT,NOLOG_INPUT, LOG_OUTPUT and NOLOG_OUTPUT. Once a tag is set on a Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the tag unless it is overridden by theopposite tag (in other words, PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
NOPASSWD and PASSWD
By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag. Likea Runas_Spec, the NOPASSWD tag sets a default for the commands that follow it in the Cmnd_Spec_List. Conversely, the PASSWD tag can be used to reverse things.For example:
ray rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
would allow the user ray to run /bin/kill, /bin/ls, and /usr/bin/lprm as root on the machine rushmore withoutauthenticating himself. If we only want ray to be able to run /bin/kill without a password the entry would be:
ray rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
Note, however, that the PASSWD tag has no effect on users who are in the group specified by the exempt_group option.
By default, if the NOPASSWD tag is applied to any of the entries for a user on the current host, he or she will be able to run ''sudo -l'' without apassword. Additionally, a user may only run ''sudo -v'' without a password if the NOPASSWD tag is present for all a user's entries that pertain to the currenthost. This behavior may be overridden via the verifypw and listpw options.