I accidentally deleted the
sudoers file on macOS; is there any way to recover it?
And once you've recovered it, how do you set it to mode 0440 and set its owner to
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
If I understand your problem correctly, then currently you don't have sudoers and you are trying to do sudo and it's not working. In this case, to get sudo working you can do the following :
To check sudo is running fine
cd /etc and
sudo vim sudoers. You should able to view sudoers file via vim editor. Any read/write operation in /etc would require the sudo command.
I know this is a bit surprising that even after not having sudoers, via UI we can do operations in /etc. But it worked for me :)
I'm assuming you are trying to run a
sudo command and it's giving you an error that
/etc/sudoers does not have the correct permissions?
If you have previously granted your account
Admin status, you should be able to fix the permissions through the GUI. Open the “/etc” folder in Finder (“Go” -> “Go to Folder…”), then open the
sudoers file properties. Click the lock. Grant the
read-only, and the
no access. The permissions should now be correct.
If you did not put yourself in the
admin group, you will need to reboot OSX into single user mode and perform the command
chmod 0440 /etc/sudoers.
Enable the root user using system preferences, and then create /etc/sudoers while logged in as the root user using
touch /etc/sudoers; chmod 440 /etc/sudoers
Note: Since the command is run as root in this case, and the group id of
/etc is 0, it should by default be owned by the correct user and group after re-creation, but if for some reason it isn't, run
chown root:wheel /etc/sudoers
After you have created
/etc/sudoers use visudo to insert this code into it:
# # Sample /etc/sudoers file. # # This file MUST be edited with the 'visudo' command as root. # # See the sudoers man page for the details on how to write a sudoers file. ## # Override built-in defaults ## Defaults env_reset Defaults env_keep += "BLOCKSIZE" Defaults env_keep += "COLORFGBG COLORTERM" Defaults env_keep += "__CF_USER_TEXT_ENCODING" Defaults env_keep += "CHARSET LANG LANGUAGE LC_ALL LC_COLLATE LC_CTYPE" Defaults env_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME" Defaults env_keep += "LINES COLUMNS" Defaults env_keep += "LSCOLORS" Defaults env_keep += "SSH_AUTH_SOCK" Defaults env_keep += "TZ" Defaults env_keep += "DISPLAY XAUTHORIZATION XAUTHORITY" Defaults env_keep += "EDITOR VISUAL" Defaults env_keep += "HOME MAIL" Defaults lecture_file = "/etc/sudo_lecture" ## # User alias specification ## # User_Alias FULLTIMERS = millert, mikef, dowdy ## # Runas alias specification ## # Runas_Alias OP = root, operator ## # Host alias specification ## # Host_Alias CUNETS = 22.214.171.124/255.255.0.0 # Host_Alias CSNETS = 126.96.36.199, 188.8.131.52/24, 184.108.40.206 # Host_Alias SERVERS = master, mail, www, ns # Host_Alias CDROM = orion, perseus, hercules ## # Cmnd alias specification ## # Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less ## # User specification ## # root and users in group admin can run anything on any machine as any user root ALL = (ALL) ALL %admin ALL = (ALL) ALL ## Read drop-in files from /private/etc/sudoers.d ## (the '#' here does not indicate a comment) #includedir /private/etc/sudoers.d
If you aren't an admin, you can boot the system into single-user-mode instead (this can be done by powering off the device and holding command+s upon startup) and run:
mount -uw /
and you will be in the terminal with root privileges, and you will be able to run the above commands to set up
Note: Single-user-mode only exists on Intel macs. If you own an M1 mac, you can access a menu similar to recovery mode by holding down the power key while turning the device on, but using this menu requires admin authentication.
The answers above cover the default contents of the file, how to move it into place with Finder and change it's permissions. However, sudo will complain unless the owner of the sudoers file is root. The only way to change the owner without sudo is via this command:
osascript -e 'do shell script "chown root:wheel /etc/sudoers" with administrator privileges'
Building on the other answers here. I ran into an issue where I inadvertently botched the admin group line in the default sudoers file.
This will copy the existing sudoers file locally.
osascript -e 'do shell script "cp /etc/sudoers /Users/myuser && chown myuser /Users/myuser/sudoers" with administrator privileges'
Then you can follow things up with a copy back once you have edited the local copy.
osascript -e 'do shell script "cp /Users/myuser/sudoers /etc/sudoers && chown root /etc/sudoers" with administrator privileges'