20

Can you please direct me to some examples and more detailed instruction on /etc/sudoers.d/

I'd like to give some group permission to sudo some commands, but in a proper way not to create unnecessary loopholes in the Ubuntu security model on a multi-user machine.

In ancient times I did some simple sudoers customisations, but apparently now /etc/sudoers.d/ is a more proper way and I'd like to better understand it.

31

Looks like nobody dared so I did my own research. Here are the results.

As this thread https://superuser.com/questions/869144/why-does-the-system-have-etc-sudoers-d-how-should-i-edit-it emphasizes /etc/sudoers is a system-wide configuration file that gets changed on system upgrades and is highly fragile to improper changes. I.e. you may loose system access or make it not to boot-up any more with improper changes.

$ sudo cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#

(... some other content ...)

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Contrary to what you may think the #includedir directive is not comment-out. It is valid and works to include all files in /etc/sudoers.d directory.

Content of this directory survives system upgrades as well as sudo is lees strict about it:

  1. Mistakes in the file did not cause sudo to fail.
  2. Permission rules appear less strict.

Therefore it is less likely that you bring the system down with your mistakes.

$ ls -l /etc/sud*
-r--r----- 1 root root  755 sty 20 17:03 /etc/sudoers

/etc/sudoers.d:
total 7
-r--r----- 1 root root 958 mar 30  2016 README
$ sudo cat /etc/sudoers.d/README
#
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
# 
#   #includedir /etc/sudoers.d
# 
# This will cause sudo to read and parse any files in the /etc/sudoers.d 
# directory that do not end in '~' or contain a '.' character.
# 
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
# 
# Note also, that because sudoers contents can vary widely, no attempt is 
# made to add this directive to existing sudoers files on upgrade.  Feel free
# to add the above directive to the end of your /etc/sudoers file to enable 
# this functionality for existing installations if you wish!
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.
#

Please note that files in this directory shall be edited with visudocommand:

$ sudo visudo -f /etc/sudoers.d/veracrypt
  GNU nano 2.5.3        File: /etc/sudoers.d/veracrypt.tmp                      

# Users in the veracryptusers group are allowed to run veracrypt as root.
%veracryptusers ALL=(root) NOPASSWD:/usr/bin/veracrypt

Please note that visudo may use different editors for the actual task as described here: https://help.ubuntu.com/community/Sudoers

Here are a few more links that I found helpful:

  • 3
    It is not true that mistakes in files in /etc/sudoers.dcan not bring down sudo. Those files are concatenated to /etc/sudoers. The same rules apply to those files. – tobltobs Oct 18 '17 at 16:52
  • 1
    That's right right that you CAN bring the system down by improper file, howver it is LESS LIKELY. #includedir is not merely a simple stupid concatenation - while including there are some check done so the most obvious errors shall be detected and that you can easily recover. Be careful however - you can always hurt yourself with a sharp knife, so handle it with care ;-) – Pawel Debski Oct 23 '17 at 17:45
  • 8
    I'd love to meet the guy who thought #include in this file should be active and not commented out. Crazy. – HörmannHH Jan 24 '18 at 17:15
  • 4
    @RichardRiley see unix.stackexchange.com/questions/244064/… – Xunnamius Jun 13 '18 at 23:25
  • You don't know how your answer helped me. Thanks a lot man. – Rhuan Karlus May 6 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.