EDIT: @steeldriver in the comments pointed to this being a bug in some versions of visudo in processing EDITOR=, [ Bug 942 - visudo fails if $EDITOR contains quotes ] - the correlation to centos versions was happenstance.

I have been writing an internal installer script and came across a behavior I don't know how to explain.


$ _sudoers_search_string="someuser ALL="
$ _sudoers_entry="someuser ALL= NOPASSWD:SETENV: /usr/bin/someprogram"
# ADD line to sudoers file
$ echo "${_sudoers_entry}" | sudo EDITOR='tee -a' visudo 1>/dev/null
# REMOVE line
$ sudo EDITOR="sed -i -e '/.*${_sudoers_search_string}/d'" visudo

This works fine. I was then testing and on Cent7, I ran into the following error with that code:

sed: -e expression #1, char 1: unknown command: `''
visudo: /etc/sudoers.tmp unchanged

And in experimenting to find working code:

sed: -e expression #1, char 10: unterminated address regex

Seemingly no combination of quoting and escaping was working until I made the following changes:

Cent7 (changed lines needed to get it working shown)

$ _sudoers_search_string="someuser\sALL="
$ sudo EDITOR="sed -i -e /.*${_sudoers_search_string}/d" visudo

My question(s): Why does it behave like this? (And is there code that will work for both versions of CentOS and bash?)

Cent6 = GNU bash, version 4.1.2(2)-release (x86_64-redhat-linux-gnu)
Cent7 = GNU bash, version 4.4.19(1)-release (x86_64-redhat-linux-gnu)
  • It seems that trying to stuff all that into EDITOR just doesn't work: it seems that when visudo actually invokes $EDITOR, the single quotes are not respected. – glenn jackman Jun 18 at 20:20
  • 4
    The difference i snot in the variable expansion, but in how $EDITOR is used by visudo. – Kusalananda Jun 18 at 22:17
  • 1
    ... perhaps Bug 942 - visudo fails if $EDITOR contains quotes and you're seeing sudo versions before and after the fix? – steeldriver Jun 18 at 23:23
  • I'm surprised that sed command ever worked. The unescaped /s in /usr/bin/someprogram would break the sed command. BTW, does Centos use the /etc/sudoers.d/ directory (would require a line like @includedir /etc/sudoers.d in /etc/sudoers)? That would allow you to just create a file in that directory to add a rule, or delete the file to remove it - but you have to be extremely careful not to break sudo with a bad rule. – cas Jun 19 at 3:15
  • @steeldriver after testing - I am pretty sure your answer is correct. Updating might be impractical, but it gives me options to just make different code paths. If you want, please submit as the answer and I will mark it as such. Ty again – solenoid Jun 21 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.