Drop-in files, package-installed rules, and #includedir

A monolithic /etc/sudoers works for one host. A fleet of one hundred hosts with five operators, three applications, and a break-glass account needs modular sudoers.

/etc/sudoers.d/

sudo supports a drop-in directory: /etc/sudoers.d/. Files in this directory whose names do not end in ~ (backup files) and that are not .disabled are parsed in lexical order alongside /etc/sudoers.

$ ls -l /etc/sudoers.d/

-r--r----- 1 root root  450 Aug  9 11:11 10-operators
-r--r----- 1 root root  270 Aug  9 11:11 20-myapp
-r--r----- 1 root root  180 Aug  9 11:11 30-breakglass
-r--r----- 1 root root  90  Aug  9 11:11 README

Naming convention

Use a leading number to force order:

10-operators     # human admin rules (early — broad)
20-myapp         # application service rules
20-other-app     # second application
30-monitoring    # monitoring agent rules
40-breakglass    # emergency access rules (last)

Permissions and ownership

Drop-ins must be:

• Owned by root.
• Mode 0440 (or stricter).
• Filename ending in something other than ~.

Anything else is silently ignored. visudo enforces this on save.

Package-installed rules

Some packages install sudoers drop-ins of their own:

$ dpkg -L sudo | grep sudoers; rpm -ql sudo | grep sudoers

/etc/sudoers
/etc/sudoers.d/README
/usr/share/doc/sudo/examples/sudoers
/usr/lib/sudo/sudoers.so
/usr/share/doc/sudo/examples/CHANGES

$ grep -r . /etc/sudoers.d/ 2>/dev/null | grep -v 'README' | head -10

/etc/sudoers.d/10-operators:%ops ALL=(ALL) ALL
/etc/sudoers.d/20-myapp:myapp ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp.service

#includedir

At the bottom of /etc/sudoers you will find:

#includedir /etc/sudoers.d

The # prefix is unusual; it makes the line a directive rather than a comment. sudo parses files in the named directory in lexical order.

Version control

Production hosts benefit from keeping /etc/sudoers.d/ in version control:

cd /etc/sudoers.d
git init
git add .
git commit -m "initial sudoers.d state"

A configuration-management tool (Ansible, Puppet, Chef) is the production-grade equivalent. The discipline: every change is reviewed, every host gets the same drop-ins, every drift is audited.

Auditing package-managed sudoers

$ dpkg -L sudo | grep -E 'sudoers|/etc/sudoers' ; rpm -V sudo | grep sudoers

/etc/sudoers
/etc/sudoers.d/README

1. Use leading numbers to control drop-in order
2. Use a README in /etc/sudoers.d/ that explains the convention
3. **Edit every file with visudo -f FILE.** Validate before save
4. Keep /etc/sudoers.d/ in version control (or in configuration management)
5. Audit quarterly for unexpected files: find /etc/sudoers.d -type f -not -name README | xargs -I {} visudo -c -f {}
6. Match every drop-in to a documented purpose. An anonymous file is a finding

Knowledge check