5

Are the files in /etc/sudoers.d read in a particular order? If so, what is the convention for that ordering?

  • The sorted order described in answers is typical for other .d directories, too, like /etc/sysctl.d/ or /etc/udev/rules.d/ or whatever. Suggestion: make sure to use different leading numbers when order matters. Sort order of the following filename characters matters for order (for sudoers at least), but you should only use the same leading digits for two files if order really doesn't matter. This helps other humans see what's going on. – Peter Cordes Feb 11 '18 at 7:06
17

From man sudoers, the exact position found with this command:

$ LESS='+/sudo will suspend processing' man sudoers

Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. A consistent number of leading zeroes in the file names can avoid such problems.

That's under the title: Including other files from within sudoers

$ LESS='+/Including other files from within sudoers' man sudoers

Lexical order is also called "dictionary order" as given by the values defined by the environment variable LC_COLLATE when the locale is C (numbers then Uppercae then lowercase letters). That's the same order as given by LC_COLLATE=C ls /etc/sudoers.d/.

The list of files included and the specific order in which they are loaded could be exposed with:

$ visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/README: parsed OK
/etc/sudoers.d/me: parsed OK
/etc/dirtest/10-defaults: parsed OK
/etc/dirtest/1one: parsed OK
/etc/dirtest/2one: parsed OK
/etc/dirtest/30-alias: parsed OK
/etc/dirtest/50-users: parsed OK
/etc/dirtest/Aone: parsed OK
/etc/dirtest/Bone: parsed OK
/etc/dirtest/aone: parsed OK
/etc/dirtest/bone: parsed OK
/etc/dirtest/zone: parsed OK
/etc/dirtest/~one: parsed OK
/etc/dirtest/éone: parsed OK
/etc/dirtest/ÿone: parsed OK

Note that the order is not UNICODE but C.

3

From the sudoers manual (regarding the #includedir directive):

#includedir /etc/sudoers.d

sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files. Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. Using a consistent number of leading zeroes in the file names can be used to avoid such problems.

See man 5 sudoers.

The lexical ordering mentioned above is the same ordering that you get from ls (or echo *) in the C or POSIX locale.

  • 1
    You can do LC_COLLATE ls but not with echo * as the asterisk will be expanded by the present shell, which may have a different COLLATE value. I mean LC_COLLATE=C echo * will probably fail to reproduce the correct order. You need to do LC_COLLATE=C shell -c 'echo *' – Isaac Feb 11 '18 at 1:31
  • @isaac Correct. – Kusalananda Feb 11 '18 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.