10

In /etc/sudoers, it says:

# This file MUST be edited with the 'visudo' command as root.

My question is, why must this file be edited with visudo?

It seems I was able to edit the file successfully with gedit, by issuing:

sudo gedit /etc/sudoers

If I was able to edit it with gedit, why must I use visudo?

3 Answers 3

21

It is just safer to use visudo. You can edit /etc/sudoers directly, but if you make a typo there, you will not be able to use sudo anymore. And won't be able to fix your error.

visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors.

You can read more by:

man visudo
3
  • Thanks! An off-topic question if you don't mind: what is the difference between # and % in the sudoers file? Are they both there to indicate the line is a comment?
    – Tosh
    Commented May 19, 2015 at 20:17
  • 4
    Only # is a comment. % is for group. And if you do not know file format, you definitely should not directly edit sudoers.
    – Pilot6
    Commented May 19, 2015 at 20:19
  • Thanks again. I have to do it following the instructions here winscp.net/eng/docs/faq_su.
    – Tosh
    Commented May 19, 2015 at 20:21
3

When you use visudo, if you manage to introduce a syntax error, visudo just exits with a prompt saying "What now?", but it doesn't give you any options on-screen.

However, the options are stated in the visudo manpage:

visudo parses the sudoers file after the edit and will not save the
changes if there is a syntax error. Upon finding an error, visudo will
print a message stating the line number(s) where the error occurred
and the user will receive the "What now?" prompt. At this point the
user may enter 'e' to re-edit the sudoers file, 'x' to exit without
saving the changes, or 'Q' to quit and save changes. The 'Q' option
should be used with extreme care because if visudo believes there to
be a parse error, so will sudo and no one will be able to sudo again
until the error is fixed. If 'e' is typed to edit the sudoers file
after a parse error has been detected, the cursor will be placed on
the line where the error occurred (if the editor supports this
feature).

However, this is pretty much a wall of text, and not very intuitive.

To avoid confusion if you get a syntax error, I'll recommend that you define the following function in your ~/.bashrc (or another file sourced from ~/.bashrc).

# Improved visudo command
editsudo () {
  echo "Valid options at the 'What now?' prompt:"
  echo "  e : Re-edit the sudoers file"
  echo "  x : Exit without saving the changes"
  echo "  Q : Quit and save changes (NOT recommended)"
  sudo visudo
}

Now this has 2 advantages:

  1. The command editsudo ensures to run sudo visudo (so it's shorter).
  2. The command editsudo prints a help text first, so that if you exits out with an error you have the relevant info right above.
1

Straight from the horse's mouth, man visudo:

visudo edits the sudoers file in a safe fashion, analogous to vipw(8). visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors before installing the edited file. If the sudoers file is currently being edited you will receive a message to try again later.

visudo parses the sudoers file after editing and will not save the changes if there is a syntax error. Upon finding an error, visudo will print a message stating the line number(s) where the error occurred and the user will receive the “What now?” prompt. [...]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .