Looks like nobody dared so I did my own research. Here are the results.
As this thread https://superuser.com/questions/869144/why-does-the-system-have-etc-sudoers-d-how-should-i-edit-it emphasizes /etc/sudoers is a system-wide configuration file that gets changed on system upgrades and is highly fragile to improper changes. I.e. you may loose system access or make it not to boot-up any more with improper changes.
$ sudo cat /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
(... some other content ...)
# See sudoers(5) for more information on "#include" directives:
Contrary to what you may think the
#includedir directive is not comment-out. It is valid and works to include all files in
Content of this directory survives system upgrades as well as sudo is lees strict about it:
- Mistakes in the file did not cause sudo to fail.
- Permission rules appear less strict.
Therefore it is less likely that you bring the system down with your mistakes.
$ ls -l /etc/sud*
-r--r----- 1 root root 755 sty 20 17:03 /etc/sudoers
-r--r----- 1 root root 958 mar 30 2016 README
$ sudo cat /etc/sudoers.d/README
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
# #includedir /etc/sudoers.d
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in '~' or contain a '.' character.
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
# Note also, that because sudoers contents can vary widely, no attempt is
# made to add this directive to existing sudoers files on upgrade. Feel free
# to add the above directive to the end of your /etc/sudoers file to enable
# this functionality for existing installations if you wish!
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.
Please note that files in this directory shall be edited with
$ sudo visudo -f /etc/sudoers.d/veracrypt
GNU nano 2.5.3 File: /etc/sudoers.d/veracrypt.tmp
# Users in the veracryptusers group are allowed to run veracrypt as root.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt
Please note that
visudo may use different editors for the actual task as described here: https://help.ubuntu.com/community/Sudoers
Here are a few more links that I found helpful: