Why do I have to edit /etc/sudoers with visudo?

Question

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is this?

[Cross-site duplicate](https://unix.stackexchange.com/q/27594/194482) — MD XF, Feb 19 '18 at 03:50

Zoredache · Accepted Answer · 2009-06-16T02:03:28.003

75

You use visudo mostly to prevent from breaking your system. Visudo runs checks on your changes to make sure you didn't mess anything up. If you did mess something up, you could completely wreck your ability to fix it or do anything requiring privileges without rebooting into a rescue mode.

The man page describes this.

visudo edits the sudoers file in a safe fashion, analogous to vipw(8). visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors. If the sudoers file is currently being edited you will receive a message to try again later.

edited Jun 16 '09 at 02:03

answered Jun 16 '09 at 01:57

Zoredache

130,897
41
276
420

4

Interesting! +1, for illustrating a simple explanation for something that I should have known a long time ago :) – Greg Meehan Jun 16 '09 at 01:58
7

The behaviour of visudo is available generically as a command called sudoedit. This does the same lock/copy/edit/copy/unlock cycle (though obviously not with the parse step). One advantage this has is that it lets you give people sudo access to edit root-owned files without launching an editor as root, which might let them launch a shell from within the editor. If I shell out of my editor while running sudoedit, my euid is still my own. – James F Jun 16 '09 at 07:38

score 19 · Answer 2 · edited Jun 18 '15 at 15:27

19

Zoredache answer is perfect.

One more thing that can be worth to mention. You can use you favorite editor by setting EDITOR or VISUAL:

export EDITOR=whatevertexteditoryouwant
export VISUAL=whatevertexteditoryouwant

Or:

EDITOR=whatevertexteditoryouwant visudo

edited Jun 18 '15 at 15:27

muru

589
8
26

answered Jun 16 '09 at 07:19

cstamas

6,707
25
42

If you do that, it will still do the syntax-check step, or it will be equivalent of calling sudoedit like @James F suggested? – o0'. Dec 25 '11 at 11:57
Yes is the answer to your question. You can use almost any editor you can invoke from cli. – cstamas Dec 25 '11 at 18:20
3

It was not a yes or no question :V – o0'. Dec 25 '11 at 20:45
6

It will **do** the syntax check. – cstamas Dec 26 '11 at 08:59

Why do I have to edit /etc/sudoers with visudo?

2 Answers2

Linked