Are the files in /etc/sudoers.d read in a particular order? If so, what is the convention for that ordering?
asked Feb 10, 2018 at 22:45
2 Answers
From man sudoers, the exact position found with this command:
$ LESS='+/sudo will suspend processing' man sudoers
Files are parsed in sorted lexical order. That is,
/etc/sudoers.d/01_firstwill be parsed before/etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric,/etc/sudoers.d/1_whoopswould be loaded after/etc/sudoers.d/10_second. A consistent number of leading zeroes in the file names can avoid such problems.
That's under the title: Including other files from within sudoers
$ LESS='+/Including other files from within sudoers' man sudoers
Lexical order is also called "dictionary order" as given by the values defined by the environment variable LC_COLLATE when the locale is C (numbers then Uppercae then lowercase letters). That's the same order as given by LC_COLLATE=C ls /etc/sudoers.d/.
The list of files included and the specific order in which they are loaded could be exposed with:
$ visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/README: parsed OK
/etc/sudoers.d/me: parsed OK
/etc/dirtest/10-defaults: parsed OK
/etc/dirtest/1one: parsed OK
/etc/dirtest/2one: parsed OK
/etc/dirtest/30-alias: parsed OK
/etc/dirtest/50-users: parsed OK
/etc/dirtest/Aone: parsed OK
/etc/dirtest/Bone: parsed OK
/etc/dirtest/aone: parsed OK
/etc/dirtest/bone: parsed OK
/etc/dirtest/zone: parsed OK
/etc/dirtest/~one: parsed OK
/etc/dirtest/éone: parsed OK
/etc/dirtest/ÿone: parsed OK
Note that the order is not UNICODE but C.
From the sudoers manual (regarding the #includedir directive):
#includedir /etc/sudoers.d
sudowill read each file in/etc/sudoers.d, skipping file names that end in~or contain a.character to avoid causing problems with package manager or editor temporary/backup files. Files are parsed in sorted lexical order. That is,/etc/sudoers.d/01_firstwill be parsed before/etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric,/etc/sudoers.d/1_whoopswould be loaded after/etc/sudoers.d/10_second. Using a consistent number of leading zeroes in the file names can be used to avoid such problems.
See man 5 sudoers.
The lexical ordering mentioned above is the same ordering that you get from ls (or echo *) in the C or POSIX locale.
answered Feb 10, 2018 at 22:51
-
1You can do
LC_COLLATE lsbut not withecho *as the asterisk will be expanded by the present shell, which may have a different COLLATE value. I meanLC_COLLATE=C echo *will probably fail to reproduce the correct order. You need to doLC_COLLATE=C shell -c 'echo *'– user232326Feb 11, 2018 at 1:31 -
.ddirectories, too, like/etc/sysctl.d/or/etc/udev/rules.d/or whatever. Suggestion: make sure to use different leading numbers when order matters. Sort order of the following filename characters matters for order (for sudoers at least), but you should only use the same leading digits for two files if order really doesn't matter. This helps other humans see what's going on.