visudo - edit the sudoers file

visudo [ -c ] [ -f sudoers ] [ -q ] [ -s ] [ -V ]

locks and edits sudoers , provides basic sanity checks, and checks for parse errors.

-c check-only . The existing sudoers file will be checked for syntax and a message will be printed to the standard output detailing the status of sudoers.
> sudo visudo -c
Password:
/private/etc/sudoers file parsed OK
-f alternate sudoers file location. default, /private/etc/sudoers.
-q quiet. Details about syntax errors are not printed. combined with -c .
-s strict checking .
If an alias is used before it is defined, visudo will consider this a parse error.
It is not possible to differentiate between an alias and a hostname or username that consists solely of uppercase letters, digits, and underscore ('_') .
-V version
The lock file used is the specified sudoers file with ".tmp" appended to it.

visudo will only use a set editors, which may be overridden via the editor sudoers Default variable. This list defaults to the path to vi(1) on your system, as determined by the configure script. visudo does not honor the VISUAL or EDITOR environment variables unless they contain an editor in the editors list. If visudo is configured with the --with-enveditor flag or the enveditor Default variable is set in sudoers, visudo will use any the editor defines by VISUAL or EDITOR. Note that this can be a security hole since it allows the user to execute any program they wish simply by setting VISUAL or EDITOR.

Upon finding an error, visudo prints a message stating the line number(s) of the error and "What now?" may enter "e" to re-edit the sudoers file, "x" to exit without saving the changes, or "Q" to quit and save changes. The "Q" option should be used with extreme care because if visudo believes there to be a parse error, so will sudo and no one will be able to sudo again until the error is fixed. If "e" is typed to edit the sudoers file after a parse error has been detected, the cursor will be placed on the line where the error occurred (if the editor supports this feature).

ENVIRONMENT

These environment variables are used only if visudo was configured with the --with-env-editor option:
  • VISUAL Invoked by visudo as the editor to use
  • EDITOR Used by visudo if VISUAL is not set

    FILES

    /private/etc/sudoers.tmp Lock file
    /private/etc/sudoers List of who can run what
    #no Host alias specification 
#no User alias specification 
#no Cmnd alias specification

# Defaults specification
Defaults    env_reset
Defaults    env_keep += "BLOCKSIZE"
Defaults    env_keep += "COLORFGBG COLORTERM"
Defaults    env_keep += "__CF_USER_TEXT_ENCODING"
Defaults    env_keep += "CHARSET LANG LANGUAGE LC_ALL LC_COLLATE LC_CTYPE"
Defaults    env_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME"
Defaults    env_keep += "LINES COLUMNS"
Defaults    env_keep += "LSCOLORS"
Defaults    env_keep += "SSH_AUTH_SOCK"
Defaults    env_keep += "TZ"
Defaults    env_keep += "DISPLAY XAUTHORIZATION XAUTHORITY"
Defaults    env_keep += "EDITOR VISUAL"
#no Runas alias specification

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel    ALL=(ALL)   ALL

# Same thing without a password
# %wheel    ALL=(ALL)   NOPASSWD: ALL

# Samples
# %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users  localhost=/sbin/shutdown -h now

    DIAGNOSTICS

    If a syntax error is detected in sudoers return code will be1 .

    sudoers file busy, try again later. sudoers file busy, try again later. Someone else is currently editing the sudoers file.

    /private/etc/sudoers.tmp: Permission denied You didn't run visudo as root.

    Can't find you in the passwd database

    Warning: undeclared Alias referenced near ...
    Either a {User,Runas,Host,Cmnd}_Alias is used before it's definition or
    there is a user or hostname listed that consists solely of uppercase letters, digits, and the underscore ('_') character. This can be ignored
    In -s (strict) mode these considered are errors.

    Warning: runas_default set after old value is in use ... You have a runas_default Defaults setting listed in the sudoers file after its value has already been used. This means that entries prior to the runas_default setting will match based on the default value of runas_default (root) whereas entries after the runas_default setting will match based on the new value. This is usually unintentional and in most cases the set- ting should be placed before any Runas_Alias or User specifications. In -s (strict) mode this is an error, not a warning.

    SEE vi(1), sudoers(5), sudo(8), vipw(8) Todd Miller sudo.ws/sudo/history.html for more details.

    CAVEATS There is no easy way to prevent a user from gaining a root shell if the editor used by visudo allows shell escapes.