5

I have a sudoers file stored in our svn repo. I want to svn export it to /etc/sudoers, but can't do it because sudo detects that it was not edited by visudo and throws syntax errors. What exactly does visudo -f do, and can I do the following:

cd /tmp && svn export <URL>/sudoers &&  visudo < /tmp/sudoers

without manual intervention?

Improve this question
1
  • 3
    It's not because it was not edited by visudo, it's because it did had syntax errors. Also check the permissions.
    – Stéphane Chazelas
    Jun 13, 2013 at 21:51

2 Answers 2

Reset to default
10

It's probably not because it was not edited by visudo, it's because it did have syntax errors. Also check the permissions. It's perfectly fine to edit /etc/sudoers without using visudo. visudo is only there to guarantee exclusive access and check the syntax before committing to the actual file. Having said that, to answer your question, you can do:

VISUAL="cp /tmp/sudoers" visudo

visudo calls your preferred editor with /etc/sudoers.tmp, checks the syntax on the new content of the file once the editor has returned and commits to /etc/sudoers when happy. By setting your preferred editor to cp /tmp/sudoers, you're actually telling it to do cp /tmp/sudoers /etc/sudoers.tmp.

(storing that sudoers temp file in a a world writeable directory like /tmp sounds dangerous to me)

Improve this answer
3
  • This is a very interesting idea. Two comments though. 1) VISUAL seem to take precedence over EDITOR, so I would go for that. 2) My version of visudo seem to to not allow any custom editor unfortunately because of security reasons.
    – Tarrasch
    Feb 19, 2015 at 21:58
  • To other over-automating venturers. It's basically impossible to do this. Save a few hours of your life and just do something like this in your dotfiles: github.com/Tarrasch/dotfiles/commit/…
    – Tarrasch
    Feb 19, 2015 at 22:26
  • @Tarrasch, indeed. I had completely forgotten this answer when answering that one (where I point out that VISUAL takes precedence over EDITOR).
    – Stéphane Chazelas
    Feb 20, 2015 at 11:03
6

I edit and deploy sudoers all the time. Make sure you do the following:

  • Use visudo -c -f <filename> to check the syntax before you check it in to svn.
  • When you deploy make sure the permissions are 0440 and owned by root:root (or root:wheel on BSD derivatives).

If your the host you use to check in runs a different OS than the one you're deploying to then you should also run visudo -c -f <filename> on the target system before copying it into place.

Improve this answer
1
  • Thanks for the visudo -c -f . Using that in my script provided the exit code 1 I need to abort if things are not right.
    – dperry1973
    Jun 14, 2013 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .