147

I need to edit /etc/sudoers from a script to add/remove stuff from white lists.

Assuming I have a command that would work on a normal file, how could I apply it to /etc/sudoers?

Can I copy and modify it, then have visudo replace the original with the modified copy? By providing my own script in $EDITOR?

Or can I just use the same locks and cp?

The question is more about potential issues than about just finding something that works.

14 Answers 14

195

Old thread, but what about:

echo 'foobar ALL=(ALL:ALL) ALL' | sudo EDITOR='tee -a' visudo
14
  • 14
    This is a great answer. The whole subshell should be executed as root, e.g. echo "$USER ALL=NOPASSWD:/usr/bin/rsync" | (sudo su -c 'EDITOR="tee" visudo -f /etc/sudoers.d/rsync').
    – simon
    Aug 19, 2015 at 21:58
  • 3
    This answer works great! I use it for postinst skripts in debian packages. thanks! Since this is always root, it gets short and handy: echo "$CONFIGLINE" | (EDITOR="tee -a" visudo) Jan 5, 2016 at 16:05
  • 7
    I just want to point out a major nuance to @BorisDäppen's answer: the -a flag to EDITOR="tee": it will append line to the file, not only overwrite the first line. I didn't catch the different at first and I couldn't figure the way to append. I hope I can find some people some time by pointing that directly ;-) Apr 16, 2017 at 13:37
  • 4
    can someone explain me how this work i mean isn't the semicolon required after EDITOR='tee -a'. I know that will break the command. EDITOR is a shell variable and visudo is yet another command so here we are passing EDITOR and visudo in same command line. how does that really works ?
    – Sagar
    Aug 11, 2017 at 16:04
  • 2
    To prevent duplicate records: if [ -z "$(grep 'foobar ALL=(ALL:ALL) ALL' /etc/sudoers )" ]; then echo "foobar ALL=(ALL:ALL) ALL" | sudo EDITOR='tee -a' visudo; fi;
    – muratgozel
    Dec 8, 2019 at 23:09
46

Use visudo for this with a custom editor. This solves all the race conditions and "hack" problems with Brian's solution.

#!/bin/sh
if [ -z "$1" ]; then
  echo "Starting up visudo with this script as first parameter"
  export EDITOR=$0 && sudo -E visudo
else
  echo "Changing sudoers"
  echo "# Dummy change to sudoers" >> $1
fi

This script will add the line "# Dummy change to sudoers" to the end of sudoers. No hacks and no race conditions.

Annotated version that explains how this actually works:

if [ -z "$1" ]; then

  # When you run the script, you will run this block since $1 is empty.

  echo "Starting up visudo with this script as first parameter"

  # We first set this script as the EDITOR and then starts visudo.
  # Visudo will now start and use THIS SCRIPT as its editor
  export EDITOR=$0 && sudo -E visudo
else

  # When visudo starts this script, it will provide the name of the sudoers 
  # file as the first parameter and $1 will be non-empty. Because of that, 
  # visudo will run this block.

  echo "Changing sudoers"

  # We change the sudoers file and then exit  
  echo "# Dummy change to sudoers" >> $1
fi
6
  • 7
    This requires that sudo has been compiled with --enable-env-editor, otherwise it will only use respect the editor variable if it is one of a small set of known values.
    – Caleb
    Sep 25, 2012 at 9:47
  • It works for me (Ubuntu 12.04), but I don't understand how it works. Could someone explain how to use it properly and how it actually works? Thanks
    – MountainX
    Jun 21, 2013 at 17:18
  • Would like to note that this does not appear to work for me on 12.04 precise. I created a bash script, added +x permissions to it, and executed the file with the following output: visudo: unable to run /tmp/edit_sudoers: Exec format error visudo: /etc/sudoers.tmp unchanged Oct 25, 2013 at 5:58
  • This worked great for me, although I simply logged in as root and removed the sudo -E from the first command.
    – merlin2011
    Apr 9, 2014 at 5:33
  • I really like this answer, but it didn't work for me. I think my sudo wasn't compiled with the necessary flag.
    – Mnebuerquo
    Apr 22, 2016 at 12:59
31

You should make your edits to a temporary file, then use visudo -c -f sudoers.temp to confirm that the changes are valid and then copy it over the top of /etc/sudoers

#!/bin/sh
if [ -f "/etc/sudoers.tmp" ]; then
    exit 1
fi
touch /etc/sudoers.tmp
edit_sudoers /tmp/sudoers.new
visudo -c -f /tmp/sudoers.new
if [ "$?" -eq "0" ]; then
    cp /tmp/sudoers.new /etc/sudoers
fi
rm /etc/sudoers.tmp
6
  • It looks like you're using sudoers.tmp as a lock file, not sure how that confirms changes are valid. Shouldn't we be checking the exit status of visudo to make sure there are no errors? Nov 27, 2008 at 15:58
  • /etc/sudoers.tmp is the lockfile checked by visudo in interactive mode. visudo -c -f returns a 1 if there was an error, hence the check of the return code. Nov 27, 2008 at 16:02
  • I'm worried about using sudoers.tmp, as it looks like using visudo's internal interface, i.e., a hack. Is it standard, meaning that it is guaranteed to always be sudoers.tmp that gets used as the lock? Or do they have the freedom to change that in future? Nov 28, 2008 at 10:16
  • 2
    need to use lockfile instead of test/touch Nov 28, 2008 at 12:30
  • 2
    The manpage says it uses /tmp/sudoers.tmp so that is currently the standard. Of course it could change in the future. And yes, you are right there is a race condition. Nov 28, 2008 at 18:24
25

On most distributions (at least Debian-based, Redhat-based, openSUSE-based, etc.), you can insert a custom script into the /etc/sudoers.d/ directory, with rights 0440 - For more information see man sudo ("Including other files from within sudo") or the same information on the official site.

It might help.

4
  • Isn't it commented out though?
    – user636044
    Nov 29, 2015 at 19:02
  • 4
    @TomDworzanski: IMHO no. See man sudoers(5) and other comment.
    – pevik
    Nov 30, 2015 at 8:09
  • You're right! Thanks for the links and great answer.
    – user636044
    Nov 30, 2015 at 12:51
  • 3
    I use that directory in centos 7 as well Aug 12, 2016 at 16:39
11

visudo is supposed to be the human interface for editing /etc/sudoers. You can achieve the same by replacing the file directly, but you have to take care yourself about concurrent editing and syntax validation. Mind the r--r----- permissions.

0
10

If your sudo allows adding entries in /etc/sudoers.d, then you can use this answer by @dragon788:

https://superuser.com/a/1027257/26022

Basically you use visudo to verify the file before you copy it into /etc/sudoers.d, so you can be sure you're not breaking sudo for anyone.

visudo -c -q -f filename

This checks it and returns success (0) if it's valid, so you can use it with if, && and other script boolean operations. Once you validate, just copy it into /etc/sudoers.d and it should work. Make sure its owned by root and not writable by other.

9

Lots of answers, been working with sudo for yonks but did not have a need to automate the setup config till now. I used a mix of some of the answers above, writing my config line to the /etc/sudoers.d include location so i don't have to modify the main sudoers file, then checked that file for syntax , simple example below:

Write your line to a sudoers include file:

sudo bash -c 'echo "your_user ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/99_sudo_include_file'

Check that your sudoers include file passed the visudo syntax checks:

sudo visudo -cf /etc/sudoers.d/99_sudo_include_file
2
  • Just omit the asterisk, that shouldn't be there ^^
    – Sonata
    Feb 26, 2019 at 16:11
  • it and returns success (0) -- got it
    – Yu Da Chi
    Apr 30, 2020 at 10:38
5

Set up a custom editor. Basically it will be a script that accepts the filename (in this case /etc/sudoers.tmp), and modify and save that in place. So you could just write out to that file. When you are done, exit the script, and visudo will take care of modifying the actual sudoers file for you.

sudo EDITOR=/path/to/my_dummy_editor.sh visudo
1
  • Am I correct that all the dummy_editor.sh need contain is something like this? #!/bin/sh; echo "# my changes to sudoers" >> $1; exit 0 It seems to work for me.
    – MountainX
    Jun 21, 2013 at 17:45
5

This is the solution I came up with. It's a quick and dirty solution, but it works...

echo "username ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers

It pipes the echo output into tee which is running under sudo. Tee then appends the output into the sudoers file.

2
  • 1
    Not a proper solution, compared to the visudo which does the sanity checking as well automatically.
    – aderchox
    Nov 12, 2021 at 7:43
  • Thanks for this clear answer. very nice. Jan 10, 2022 at 8:23
4

I think the most straight forward solution is to:

Create a script addsudoers.sh

#!/bin/sh

while [ -n "$1" ]; do
    echo "$1    ALL=(ALL:ALL) ALL" >> /etc/sudoers;
    shift # shift all parameters
done

and call it with the users you want to add it as:

root prompt> ./addsudoers.sh user1 user2

For the full explanation see this answer: Adding users to sudoers through shell script

Regards!

2

Just to add a further option to the answers above, if the race condition is not a major concern, then the following command can be used to avoid manually copying a modified file to /etc/sudoers

sudo EDITOR="cp /tmp/sudoers.new" visudo

This will ensure that the new file is validated and installed correctly with permissions update.

Note that if there is an error in the /tmp/sudoers.new file then visudo will prompt for user input so it is advisable to check it with visudo -c -f /tmp/sudoers.new first.

0
0

Try to echo it. You have to run it in a subshell, though. Example:

sudo sh -c "echo \"group ALL=(user) NOPASSWD: ALL\" >> /etc/sudoers"

0

Since this question has much more pv than this one, and sed is more flexible comparing to tee, I'll just leave the link to a "better" solutin and my solution here.

Based on Valery Panov's answer, I wrote this

echo 's/^#\s*\(%wheel\s*ALL=(ALL)\s*ALL\)/\1/g' | EDITOR='sed -f- -i' visudo

to uncomment this line in /etc/sudoers

# %wheel  ALL=(ALL)       ALL
-2

This worked for me based off what others posted here. When i used other peoples script it would open visudo for me but would not make the edit. This made the edit i needed to allow all users, including standard users, to install java 7u17 for safari/firefox.

#!/usr/bin/env bash
rm /etc/sudoers.new
cp /etc/sudoers /etc/sudoers.new
echo "%everyone   ALL = NOPASSWD: /usr/sbin/installer -pkg /Volumes/Java 7 Update 17/Java 7 Update 17.pkg -target /" >> /etc/sudoers.new
cp /etc/sudoers.new /etc/sudoers

This added the %everyone blah blah blah to the bottom of the sudoers file. I had to run the script like this.

sudo sh sudoersedit.sh

Good luck :D

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.