VISUDO(8)

✨ VISUDO(8) ✨

Manual page: visudo(8), from the System Manager's Manual 💅

🎀 NAME

visudo — edit the sudoers file 💖

🦋 SYNOPSIS

visudo [-chIOPqsV] [[-f] sudoers]

🌸 DESCRIPTION

okay so visudo is the bestie that edits your sudoers file safely 🫶 It's basically the same vibe as vipw(8). It locks the sudoers file so two people can't edit it at the same time, does some basic validity checks, and checks for syntax errors before it installs your edits. If someone else is already editing it, you'll get a message telling you to try again later 😭

If the sudoers file doesn't exist yet, visudo will create it, unless your editor quits without writing anything to it.

Now, visudo parses the sudoers file after you edit it, and it won't save your changes if there's a syntax error 🙅‍♀️ When it finds one, it prints the line number(s) where things went wrong and then you get the “What now?” prompt. From there you can type ‘e’ to re-edit the file, ‘x’ to exit without saving, or ‘Q’ to quit and save your changes.

‘Q’ is giving dangerous energy, so use it with extreme caution 💀 If visudo thinks there's a syntax error, sudo will think so too. If you type ‘e’ after a syntax error has been detected, your cursor will land on the line where the error happened, as long as your editor supports that feature ✨

There are two sudoers settings that decide which editor visudo runs. Let's go through them 👑

• editor — this is a colon (‘:’) separated list of editors that are allowed to be used with visudo. visudo will pick the one that matches your SUDO_EDITOR, VISUAL, or EDITOR environment variable if it can. If not, it grabs the first editor in the list that exists and is executable. Also, sudo won't preserve SUDO_EDITOR, VISUAL, or EDITOR unless they're in the env_keep list or the env_reset option is disabled in the sudoers file. The default editor path is /usr/bin/editor, which can be changed at compile time with the --with-editor configure option 🍓
• env_editor — if this is set, visudo will use the value of SUDO_EDITOR, VISUAL, or EDITOR before falling back on the default editor list. Heads up, though: visudo usually runs as root, so this option might let a user with visudo privileges run arbitrary commands as root without logging 😳 The safer move is to put a colon-separated list of “safe” editors in the editor variable. Then visudo will only use SUDO_EDITOR, VISUAL, or EDITOR if they match a value listed in editor. If the env_reset flag is enabled, SUDO_EDITOR, VISUAL, and/or EDITOR must be in the env_keep list for env_editor to work when visudo is run through sudo. The default value is on, and you can change that at compile time with the --with-env-editor configure option 🧚

Here are the options, bestie 🎀

💅 OPTIONS 💅

• -c, --check — this turns on check-only mode 🔍 The existing sudoers file (and any other files it includes) gets checked for syntax errors. If you didn't specify the path to the sudoers file, visudo will also check the file's ownership and permissions (see the -O and -P options). It prints a message to standard output describing the status of sudoers, unless you used -q. If everything checks out, visudo exits with a value of 0. If it runs into an error, it exits with a value of 1.
• -f sudoers, --file=sudoers — point to an alternate sudoers file location, see below 🗺️ As of version 1.8.27, you can also give the sudoers path without using the -f option.
• -h, --help — shows a short help message on standard output and then exits 🙋‍♀️
• -I, --no-includes — this turns off editing of include files, unless there's already a syntax error in them. By default, visudo edits the main sudoers file and any files pulled in with @include or #include directives. Files included with @includedir or #includedir are never edited unless they have a syntax error 📁
• -O, --owner — enforces the default ownership (user and group) of the sudoers file 👤 In edit mode, the owner of the edited file gets set to the default. In check mode (-c), an error is reported if the owner is wrong. This one is on by default if you didn't specify the sudoers file.
• -P, --perms — enforces the default permissions (mode) of the sudoers file 🔐 In edit mode, the permissions of the edited file get set to the default. In check mode (-c), an error is reported if the file permissions are incorrect. This is also on by default if you didn't specify the sudoers file.
• -q, --quiet — quiet mode, where the details about syntax errors don't get printed 🤫 This is only useful when you combine it with -c.
• -s, --strict — turns on strict checking of the sudoers file 💪 If an alias gets referenced but never actually defined, or there's a cycle in an alias, visudo treats it as a syntax error. Heads up: visudo can't tell the difference between an alias and a host name or user name that's made up solely of uppercase letters, digits, and the underscore (‘_’) character.
• -V, --version — prints the visudo and sudoers grammar versions and then exits 🏷️

A sudoers file can be specified instead of the default, /etc/sudoers. The temporary file used is the specified sudoers file with “.tmp” appended to it. ‘-’ can be used to say that sudoers should be read from standard input, but only in check-only mode. Also, since the policy gets evaluated in its entirety, checking just one individual sudoers include file for syntax errors isn't enough 🙈

🧚 Debugging and sudoers plugin arguments 🧚

visudo versions 1.8.4 and higher have a flexible debugging framework. You configure it with Debug lines in the sudo.conf(5) file 🛠️

Starting with sudo 1.8.12, visudo will also parse the arguments given to the sudoers plugin. These let you override the default sudoers path name, user-ID, group-ID, and file mode 🌈 If they're present, they should be listed after the path to the plugin (so, after sudoers.so). You can specify multiple arguments, separated by white space. For example:

Plugin sudoers_policy sudoers.so sudoers_mode=0400

These are the arguments that are supported:

• sudoers_file=pathname — overrides the default path to the sudoers file 📍
• sudoers_uid=user-ID — overrides the default owner of the sudoers file. It should be a numeric user-ID.
• sudoers_gid=group-ID — overrides the default group of the sudoers file. It must be a numeric group-ID, not a group name 🔢
• sudoers_mode=mode — overrides the default file mode for the sudoers file. It should be an octal value 🦋

For more info on configuring sudo.conf(5), check out its manual 📖

---

to be continued... 💜

🎀 BUGS 🎀

okay so if you think you've found a bug in visudo, you've got two options bestie 🐛 you can file a bug report in the sudo bug database at https://bugzilla.sudo.ws/, or open an issue at https://github.com/sudo-project/sudo/issues. 💅

if email is more your thing, you can send messages to the sudo-workers mailing list at https://www.sudo.ws/mailman/listinfo/sudo-workers (that one's public 🌸) or privately to <sudo@sudo.ws> 🫶

🚨 PLEASE do not report security vulnerabilities through public GitHub issues, Bugzilla, or mailing lists!! 😭 instead, email them privately to <Todd.Miller@sudo.ws>. you're allowed to encrypt your message with PGP if you want, using the key found at https://www.sudo.ws/dist/PGPKEYS 🔐✨

💖 SUPPORT 💖

okay so there's limited free support available through the sudo-users mailing list 🦋 subscribe or search the archives at https://www.sudo.ws/mailman/listinfo/sudo-users 🧚

🙈 DISCLAIMER 🙈

visudo is provided "AS IS" 🫠 any express or implied warranties, including but not limited to the implied warranties of merchantability and fitness for a particular purpose, are totally disclaimed, no cap 💀 for the complete details, check out the LICENSE.md file distributed with sudo or https://www.sudo.ws/about/license/ 📜

---

Sudo 1.9.17p2 💜 July 27, 2023 💜 VISUDO(8) — bye bestie, go be a sudoer legend 🌈👑