Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

visudo — edit sudoers safely

6 min Ubuntu 24.04 · sudo 1.9.15

The visudo command edits /etc/sudoers and files in /etc/sudoers.d and refuses to save a rule with a grammar error.

Cheat sheet

7 commands Printable version
  • sudo visudo the main /etc/sudoers
  • sudo visudo -f /etc/sudoers.d/deploy a separate rule file
  • sudo EDITOR=vim visudo -f /etc/sudoers.d/deploy another editor
  • sudo chmod 0440 /etc/sudoers.d/deploy the mode sudo expects
  • sudo visudo -c check all files and their modes
  • sudo visudo -cf /tmp/candidate check a finished file
  • sudo -l -U deploy what deploy may run in the end

Overview

sudo lets users in by the rules in /etc/sudoers and the files of the /etc/sudoers.d directory. A mistake in these files can leave the machine without sudo, so they are edited with visudo. It opens a copy of the file in an editor (on Ubuntu nano by default; another one via EDITOR) and checks the grammar after you save. It won't write a file with an error.

text 
student@ubuntu:~$ sudo visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/90-student: parsed OK
/etc/sudoers.d/README: parsed OK

visudo -c checks the main file and every included one, along with their owner and mode. parsed OK only means the line follows the grammar. What it allows, visudo doesn't judge.

A rule reads left to right:

Part of deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart app Meaning
deploy who; %group means every member of the group
ALL= on which machine (almost always ALL)
(root) as whom to run
NOPASSWD: without typing your password
/usr/bin/systemctl restart app which command — full path and arguments

Options

4

Full list — man visudo; the rule grammar — man sudoers.

Option What it does Example
-c --check Check only — grammar, owner and mode of every sudoers file. sudo visudo -c
-f --file file Edit or check the given file instead of /etc/sudoers. sudo visudo -f /etc/sudoers.d/deploy
-s --strict Strict checking — undefined aliases too. sudo visudo -cs
-q --quiet Omit error details — with -c in scripts that rely on the exit code. sudo visudo -cq

Nothing found. Try a shorter query.

Recipes

3

Grant one command in a separate file

bash 
sudo visudo -f /etc/sudoers.d/deploy
# one line in the editor:
# deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart app
sudo chmod 0440 /etc/sudoers.d/deploy
sudo visudo -c
sudo -l -U deploy

A separate file is easy to see and easy to remove, and the main /etc/sudoers stays untouched. File requirements: a name with no dot and no trailing ~, owner root:root, mode 0440.

Check a rule before installing it

bash 
sudo visudo -cf /tmp/candidate

Check the grammar first, then the meaning: the command in a rule is a full path (find it with command -v systemctl), and the arguments are exactly the ones needed. ALL in the command position grants any command as root.

Check as the person the rule is for

bash 
sudo -u deploy sudo -n /usr/bin/systemctl restart app   # passes
sudo -u deploy sudo -n /usr/bin/systemctl stop app      # refused

-n forbids the password prompt: where there's no rule, sudo prints a password is required right away.

Troubleshooting

5

visudo: unable to open /etc/sudoers: Permission denied

visudo was run without root. Use sudo visudo.

syntax error and the What now? prompt

The saved file failed the check: visudo prints the file, line number and the spot of the error and asks what to do. e — back to the editor to fix it, x — exit without saving. Q saves the broken file — don't.

bad permissions, should be mode 0440

The file in /etc/sudoers.d was created with ordinary permissions. Run sudo chmod 0440 file and repeat sudo visudo -c.

The rule exists, but sudo doesn't see it

The file name contains a dot (deploy.conf) or ends with ~ — sudo silently skips such files, and visudo -c doesn't list them. Rename it without the dot.

The rule exists, but a password is still asked

Of all matching rules, the last one wins. The line %sudo ALL=(ALL:ALL) ALL or another file later in order can override yours. See the result with sudo -l -U name. Files in /etc/sudoers.d are read in name order — hence prefixes like 90-.

Danger zone

2

Editing sudoers with a plain editor

sudo nano /etc/sudoers will save a broken file, and sudo may stop working. Edit only through visudo, and keep a second terminal with sudo -i open until you've checked the result.

A rule that's too broad

NOPASSWD: ALL, a wildcard in the arguments, or a program that can start a shell (vim, less, find -exec) give the user full root. Allow a specific command with specific arguments.

See also

  • sudo — how sudo applies rules and what to do when it refuses.
  • users-groups — the sudo group and its membership.
  • usermod — add a user to the sudo group.
  • permissions — file permissions, 0440 included.
  • nano — the editor visudo opens on Ubuntu.
  • vim — another editor via EDITOR=vim.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…