1

tl;dr /etc/sudoers and groups implies no sudo privileges. Yet sudo --list reports ALL sudo privileges. Why the difference?

Background

On an Ubuntu 18 desktop, file /etc/sudoers has

Defaults !visiblepw
Defaults always_set_home
Defaults secure_path="/sbin:/bin:/usr/sbin:/usr/bin"
Defaults env_reset
Defaults env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

root ALL=(root) NOPASSWD:ALL

%sudo ALL=(ALL:ALL) ALL

#includedir /etc/sudoers.d

groups reports (run as user user1)

user group1 group2 ...

(there is a long list of specialized groups set by the host Administrator, none of which are sudo or root)

sudo --list reports (run as user user1)

Matching Defaults entries for user1 on host1:
    !visiblepw, always_set_home, secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL
    PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

User user1 may run the following commands on host1:
    (ALL) NOPASSWD: ALL

Inconsistent Privileges?

File /etc/sudoers and current groups would imply that my user user1 has no sudo access. User user1 is not in the group sudo or group root.
Yet sudo --list reports user1 has privilege (ALL) NOPASSWD: ALL!

What file or service or mis-understanding is happening such that user1 has sudo privilege ALL?

Improve this question
1
  • @KamilMaciorowski mentioned in an Answer Comment, I had looked past the line #includedir /etc/sudoers.d within the /etc/sudoers file. I thought this line was a comment because of the leading # character. Unexpectedly,#includedir is the syntax for including directories. @roaima Answer suggested looking at files within the /etc/sudoers.d/ directory. Thanks!
    – JamesThomasMoon
    Commented Dec 8, 2019 at 5:22

1 Answer 1

Reset to default
4

There will be a file in /etc/sudoers.d/ that provides the extra configuration to allow user1 the full access you're seeking.

Improve this answer
3
  • Indeed! sudo cat /etc/sudoers.d/group1 has %group1 ALL=(ALL) NOPASSWD:ALL.
    – JamesThomasMoon
    Commented Dec 5, 2019 at 21:18
  • 3
    @James In sudoers you probably have #includedir /etc/sudoers.d/. This is not a comment. It looks like some directive that has been commented out, but in fact #includedir (with leading #) is a directive. IMO very bad design.
    – Kamil Maciorowski
    Commented Dec 5, 2019 at 21:48
  • You are absolutely correct @KamilMaciorowski I hastily presumed #includedir ... was a commented line. I entirely forgot about this unexpected quirk of the sudoers file format. I will tweak the question.
    – JamesThomasMoon
    Commented Dec 8, 2019 at 5:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .