Sudoers overwritten by unknown instance

Question

After org.kde.pim.aconadiserver crashed on my Fedora 25 workstation after running pkill to get the progress of a dd copy and Kde did a slow restart after some time, I could not use sudo with my normal user anymore.

The answer was user is NOT in the sudoers file altough it clearly was before and I definately could use sudo before. I had to edit the sudoers file with the root user. It didn't have new user entries, it seemed to be a default file.

Because I edited the sudoers file now, I currently have no idea how to figure out when exactly it was changed and especially what changed it.

Could dnf have overwritten it in an update? And is there a way to check that (in archlinux(pacman) you can search the install scripts, maybe it is possible with dnf too?)? But the latest dnf upgrade was a week before the incident, and the last install wasat least 12 hours before the incident. And sudo was still working. Maybe the script was run after the crash, maybe a setup script for a KDE component? Or might the crash of akonadiserver or the KDE restart have caused that?

Extract of journalctl when the crash happend:

Sep 15 00:00:35 hostname sudo[29889]:     rudi : TTY=pts/3 ; PWD=/somefolder ; USER=root ; COMMAND=/bin/pkill dd -USR1
Sep 15 00:00:36 hostname sudo[29889]: pam_systemd(sudo:session): Cannot create session: Already occupied by a session
Sep 15 00:00:36 hostname sudo[29889]: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 15 00:00:36 hostname sudo[29889]: pam_unix(sudo:session): session closed for user root
Sep 15 00:00:37 hostname systemd[1]: sddm.service: Main process exited, code=killed, status=10/USR1
Sep 15 00:00:37 hostname systemd-logind[1049]: Removed session 2.
Sep 15 00:00:37 hostname kdeinit5[1685]: kdeinit5: Fatal IO error: client killed
Sep 15 00:00:40 hostname audit[4570]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4570 comm="TaskSchedulerSe" exe=2F6F70742F676
Sep 15 00:00:40 hostname audit[2462]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=2462 comm="TaskSchedulerSe" exe=2F6F70742F676
Sep 15 00:00:40 hostname audit[12260]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=12260 comm="TaskSchedulerSe" exe=2F6F70742F6
Sep 15 00:00:40 hostname audit[12435]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=12435 comm="TaskSchedulerSe" exe=2F6F70742F6
Sep 15 00:00:44 hostname at-spi-bus-launcher[1936]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":0"
Sep 15 00:00:44 hostname at-spi-bus-launcher[1936]:       after 666960 requests (666960 known processed) with 0 events remaining.
Sep 15 00:00:39 hostname polkitd[1107]: Unregistered Authentication Agent for unix-session:2 (system bus name :1.37, object path /org/kde/PolicyKit1/AuthenticationAgent, locale de_AT.UTF-8) (
Sep 15 00:00:37 hostname kdeinit5[1685]: kdeinit5: sending SIGHUP to children.
Sep 15 00:00:38 hostname systemd[1]: Stopping User Manager for UID 1000...
Sep 15 00:00:39 hostname kdeinit5[1685]: kdeinit5: sending SIGTERM to children.
Sep 15 00:00:39 hostname kdeinit5[1685]: kdeinit5: Exit.
Sep 15 00:00:40 hostname kdeinit5[1689]: The X11 connection broke (error 1). Did the X11 server die?
Sep 15 00:00:42 hostname klauncher[1686]: The X11 connection broke (error 1). Did the X11 server die?
Sep 15 00:00:42 hostname kglobalaccel5[1712]: The X11 connection broke (error 1). Did the X11 server die?
Sep 15 00:00:43 hostname akonadi_control[2001]: The X11 connection broke (error 1). Did the X11 server die?
Sep 15 00:00:46 hostname akonadiserver[2021]: org.kde.pim.akonadiserver: Control process died, committing suicide!
Sep 15 00:00:47 hostname akonadi_followupreminder_agent[2037]: org.kde.pim.akonadicore: Akonadi server running without control process!

Answer 1

The /etc/sudoers file is marked %config(noreplace), which means that if it has been edited, a yum or dnf update would not overwrite it. You'd get /etc/sudoers.rpmnew instead.

Note that by default, Fedora ships with this line:

%wheel  ALL=(ALL)   ALL

which means that users in the wheel group have full sudo privileges. You note:

... I definately could use sudo before. I had to edit the sudoers file with the root user. It didn't have new user entries, it seemed to be a default file.

It's very possible that you could use sudo before with the default file without any specific user entry. My guess is that somehow you lost membership in the wheel group. This could have happened at any time, but wouldn't take affect until you log out and in again. I suspect that it's entirely unrelated to your crash, except that you rebooted after, and then logged back in now without that group.