1

tl;dr /etc/sudoers and groups implies no sudo privileges. Yet sudo --list reports ALL sudo privileges. Why the difference?

Background

On an Ubuntu 18 desktop, file /etc/sudoers has

Defaults !visiblepw
Defaults always_set_home
Defaults secure_path="/sbin:/bin:/usr/sbin:/usr/bin"
Defaults env_reset
Defaults env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

root ALL=(root) NOPASSWD:ALL

%sudo ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d

groups reports (run as user user1)

user group1 group2 ...

(there is a long list of specialized groups set by the host Administrator, none of which are sudo or root)

sudo --list reports (run as user user1)

Matching Defaults entries for user1 on host1:
    !visiblepw, always_set_home, secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL
    PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

User user1 may run the following commands on host1:
    (ALL) NOPASSWD: ALL

Inconsistent Privileges?

File /etc/sudoers and current groups would imply that my user user1 has no sudo access. User user1 is not in the group sudo or group root.
Yet sudo --list reports user1 has privilege (ALL) NOPASSWD: ALL!

What file or service or mis-understanding is happening such that user1 has sudo privilege ALL?

  • @KamilMaciorowski mentioned in an Answer Comment, I had looked past the line #includedir /etc/sudoers.d within the /etc/sudoers file. I thought this line was a comment because of the leading # character. Unexpectedly,#includedir is the syntax for including directories. @roaima Answer suggested looking at files within the /etc/sudoers.d/ directory. Thanks! – JamesThomasMoon1979 Dec 8 '19 at 5:22
4

There will be a file in /etc/sudoers.d/ that provides the extra configuration to allow user1 the full access you're seeking.

| improve this answer | |
  • Indeed! sudo cat /etc/sudoers.d/group1 has %group1 ALL=(ALL) NOPASSWD:ALL. – JamesThomasMoon1979 Dec 5 '19 at 21:18
  • 3
    @James In sudoers you probably have #includedir /etc/sudoers.d/. This is not a comment. It looks like some directive that has been commented out, but in fact #includedir (with leading #) is a directive. IMO very bad design. – Kamil Maciorowski Dec 5 '19 at 21:48
  • You are absolutely correct @KamilMaciorowski I hastily presumed #includedir ... was a commented line. I entirely forgot about this unexpected quirk of the sudoers file format. I will tweak the question. – JamesThomasMoon1979 Dec 8 '19 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.