Computer Environment

OS: Arch linux - Manjaro

Shell: zsh


I'm trying to enable the following commands to not require a password input for my main user account: ab

sudo systemctl stop NetworkManager
sudo systemctl start NetworkManager


I've read and have tried to follow some of the online help and got so far as this by using sudo -i to create the file /etc/sudoers.d/ab with the following code:

ab ALL=(root) NOPASSWD: sudo systemctl stop NetworkManager
ALL=(root) NOPASSWD: sudo systemctl start NetworkManager


I've tried to make the following edits without success:

  • changing root to ALL
  • changing systemctl to /bin/systemctl
  • deleting sudo

Each time I make the edit and save, I cat /etc/sudoers.d/ab to check that changes were made, and I always open up a new terminal to try out the command, each time trying a combination of the following while still being asked for a password input:

sudo systemctl start NetworkManager
sudo /bin/systemctl start NetworkManager
systemctl start NetworkManager
/bin/systemctl start NetworkManager


Is starting a new terminal enough, or do I need to restart my whole system to initiate the changes?

Or maybe I'm forgetting another step?

  • I tried using visudo and adding ab ALL=(ALL:ALL) sudo systemctl stop NetworkManager but visudo said there were errors on this line.
    – MarkB
    Mar 19 '20 at 2:35
  • 1
    I don't think you should include sudo as part of the Cmnd_Spec Mar 19 '20 at 2:40
  • Thank you, but I tried editing out sudo without success.
    – MarkB
    Mar 19 '20 at 2:47
  • 1
    Always use "sudo visudo" to edit. Try ab ALL=(ALL) ALL, NOPASSWD: /bin/systemctl start NetworkManager
    – rr0ss0rr
    Mar 19 '20 at 3:30
  • 1
    The command in sudoers should use absolute paths, and shouldn't include sudo itself (unless you are running sudo sudo).
    – muru
    Mar 19 '20 at 4:25

The lines in /etc/sudoers.d/ab should probably be like this:

ab ALL=(root) NOPASSWD: /bin/systemctl stop NetworkManager
ab ALL=(root) NOPASSWD: /bin/systemctl start NetworkManager

With sudo and normal, locally stored sudoers.d files (and nothing advanced like sudoers information stored in a LDAP server), any changes to the sudoers files should take effect immediately, with no need to logout/login, start new terminals, or anything like that.

Normally sudo will log both successful and failed attempts to use it, so you should look at the appropriate log file (usually either /var/log/secure or /var/log/auth.log, depending on distribution) for messages from sudo. Those messages will include the command the user is attempting to execute through sudo, in the exact form you'll need to write it into the sudoers file to allow it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.