/usr/bin/sudo --help — Chainguard OS Manuals

From sudo 1.9.17_p2-r12 (os), captured 2026-11-05 by running sudo --help (exit 1) · terse output. permalink

sudo: /etc/sudo.conf is owned by uid 1100, should be 0
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

Options (28)

Option	Description	Source
`-A, --askpass`	Normally, if sudo requires a password, it will read it from the user's terminal.	man
`-B, --bell`	Ring the bell as part of the password prompt when a terminal is present.	man
`-b, --background`	Run the given command in the background.	man
`-C, --close-from` num	Close all file descriptors greater than or equal to num before executing a command.	man
`-D, --chdir` directory	Run the command in the specified directory instead of the current working directory.	man
`-E, --preserve-env`	Indicates to the security policy that the user wishes to preserve their existing environment variables.	man
`-e, --edit`	Edit one or more files instead of running a command.	man
`-g, --group` group	Run the command with the primary group set to group instead of the primary group specified by the target user's password database entry.	man
`-H, --set-home`	Request that the security policy set the HOME environment variable to the home directory specified by the target user's password database entry.	man
`-h, --help`	Display a short help message to the standard output and exit.	man
`-i, --login`	Run the shell specified by the target user's password database entry as a login shell.	man
`-K, --remove-timestamp`	Similar to the -k option, except that it removes every cached credential for the user, regardless of the terminal or parent process ID.	man
`-k, --reset-timestamp`	When used without a command, invalidates the user's cached credentials for the current session.	man
`-l, --list`	If no command is specified, list the privileges for the invoking user (or the user specified by the -U option) on the current host.	man
`-N, --no-update`	Do not update the user's cached credentials, even if the user successfully authenticates.	man
`-n, --non-interactive`	Avoid prompting the user for input of any kind.	man
`-P, --preserve-groups`	Preserve the invoking user's group vector unaltered.	man
`-p, --prompt` prompt	Use a custom password prompt with optional escape sequences.	man
`-R, --chroot` directory	Change to the specified root directory (see chroot(8)) before running the command.	man
`-r, --role` role	Run the command with an SELinux security context that includes the specified role.	man
`-S, --stdin`	Write the prompt to the standard error and read the password from the standard input instead of using the terminal device.	man
`-s, --shell`	Run the shell specified by the SHELL environment variable if it is set or the shell specified by the invoking user's password database entry.	man
`-t, --type` type	Run the command with an SELinux security context that includes the specified type.	man
`-U, --other-user` user	Used in conjunction with the -l option to list the privileges for user instead of for the invoking user.	man
`-T, --command-timeout` timeout	Used to set a timeout for the command.	man
`-u, --user` user	Run the command as a user other than the default target user (usually root).	man
`-V, --version`	Print the sudo version string as well as the version string of any configured plugins.	man
`-v, --validate`	Update the user's cached credentials, authenticating the user if necessary.	man

Exit status (1) from the manual page

`0`	the user is allowed to run sudo and they authenticated successfully (as required by the security policy)

Examples (7) from the manual page, untested

sudo ls /usr/local/protected
To get a file listing of an unreadable directory:
sudo -u yaz ls ~yaz
To list the home directory of user yaz on a machine where the file system holding ~yaz is not exported as root:
sudoedit -u www ~www/htdocs/index.html
To edit the index.html file as user www:
sudo -g adm more /var/log/syslog
To view system logs only accessible to root and users in the adm group:
sudoedit -u jim -g audio ~jim/sound.txt
To run an editor as jim with a different primary group:
sudo shutdown -r +15 "quick reboot"
To shut down a machine:
sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
To make a usage listing of the directories in the /home partition.

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.