Note: I would not do the following. It is not safe, and also there are enough other possibilites to destroy your system. Why exactly picking this one?
sudo rights, comes great responsibility.
However, to keep even
root from editing
sudoers file, you can make it immutable by running:
sudo chattr +i /etc/sudoers
Then add the followign aliases to your
.profile file, e.g.
alias visudo="sudo chattr -i /etc/sudoers; sudo visudo; sudo chattr +i /etc/sudoers;"
alias sudo='sudo '
It will change
visudo command to first reset immutable flag, then run
visudo , at the end make it
immutable again. See here why we need the second alias.
After resourcing the file or restarting the shell, you can use
sudo visudo as normal, but not edit it otherwise.
This is just the general idea, it needs to be enhanced to enable other arguments of
visudo and the files below
/etc/sudoers.d/. Instead of an alias, you could also use a function or script.
Note, this is not really safe:
- the moments you have
visudo running, the file is not immutable
sudo user can run
chattr -i to unset the immutable flag at any time
- you train yourself a behavior to not think before doing stuff