sudoers syntax — rules, aliases, and defaults · Linux

The sudoers file format is unusual: it is not a simple INI or YAML. It has its own grammar, its own reserved words, and rules about how to combine them. Mistakes are silent until production breaks.

The basic rule

A sudoers rule has the form:

WHO WHERE=(AS_WHOM) [NOPASSWD:] WHAT

Field	Meaning
WHO	User, group (with `%`), or User_Alias
WHERE	Host, Host_Alias, or `ALL`
`(AS_WHOM)`	Target user (default: root). Optional.
`[NOPASSWD:]`	Skip the password prompt
WHAT	Command, Cmnd_Alias, or `ALL`

Read-only / Safetwo rules per user— alice has two rules: (ALL) ALL is the broad grant; (root) /usr/bin/systemctl status ssh, /usr/bin/systemctl restart ssh is a narrowly-scoped additional grant. The second rule is what allows her to restart sshd as root. The first rule is the source of the audit volume.

$ sudo -l -U alice

User alice may run the following commands on host01:
(ALL) ALL
(root) /usr/bin/systemctl status ssh, /usr/bin/systemctl restart ssh

Illustrative output

Aliases

For fleets, listing every user or every command in every file is unmaintainable. sudoers has four alias types:

User_Alias  OPS = alice, bob, carol
Runas_Alias APP = root, www-data
Host_Alias  PROD = host01, host02, host03
Cmnd_Alias  RESTART = /usr/bin/systemctl restart ssh, /usr/bin/systemctl restart nginx

OPS PROD = (APP) RESTART

Alias	Resolves to
`User_Alias`	A list of users, groups (with `%`), or other User_Aliases
`Runas_Alias`	A list of target users (`root`, `%group`, etc.)
`Host_Alias`	A list of hosts, IPs, netgroups, or other Host_Aliases
`Cmnd_Alias`	A list of commands, with optional arguments

Defaults

The Defaults directive sets options globally or per-rule:

Read-only / Safedefaults— The Defaults block at the top of sudoers sets defaults for everyone. env_reset clears the user's environment for the privilege. secure_path ensures a known PATH for the elevated command. use_pty allocates a pseudo-terminal so the command is observable and logged correctly.

$ sudo -l | head -10

Matching Defaults entries for alice on host01:
env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty

User alice may run the following commands on host01:
...

Illustrative output

Common Defaults:

Default	Effect
`env_reset`	Clear the user’s environment, set a clean one
`secure_path`	PATH the elevated command uses
`use_pty`	Allocate a pseudo-terminal for the command
`log_input`, `log_output`	Log stdin/stdout of elevated commands
`iolog_dir`	Where input/output logs are written
`timestamp_timeout=0`	Always require re-authentication
`timestamp_timeout=5`	Default — 5 minute grace
`mail_badpass`	Email root on bad password attempts
`passwd_tries=3`	Three attempts before sudo gives up
`insults`	Insult the user on bad password (humorous, but rarely enabled)

Per-rule defaults

A Defaults can be scoped to a specific rule:

Defaults:ops !log_input, !log_output
ops ALL=(ALL) ALL

The Defaults line applies only to the rules that match the user list ops.

Least privilege: enumerate positively

Write the commands you intend to permit, one at a time, with absolute paths. Never start from ALL and carve pieces out.

Cmnd_Alias SSH_OPS = /usr/bin/systemctl restart ssh, \
                     /usr/bin/systemctl status ssh
alice ALL=(root) SSH_OPS

This is the only model that actually constrains what alice can do, because sudo grants exactly what is listed and nothing else. Every addition is a deliberate, reviewable line.

Last match wins

sudo does not stop at the first matching rule. It evaluates every entry that matches and applies the last one.

%ops ALL=(ALL) !/usr/bin/su      # intended as a deny
%ops ALL=(ALL) ALL               # this wins - the deny above is dead

Negation and exceptions

The ! operator removes a command from a list:

alice ALL=(ALL) ALL, !/usr/bin/sudo, !/usr/bin/su

Read literally, this allows alice to run anything except sudo and su. It parses cleanly. It is also not a security control.

Subtracting from ALL is not a restriction

man 5 sudoers is explicit: “It is generally not effective to ‘subtract’ commands from ALL using the ’!’ operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that… these kind of restrictions should be considered advisory at best… In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell… regardless of any ’!’ elements in the user specification.”

The bypass is one line:

cp /usr/bin/su /tmp/x && sudo /tmp/x -

A shell escape from any permitted editor, pager or interpreter does the same job without even copying a file.

Treat ! exceptions as documentation of intent, never as enforcement. Recording one as a compensating control in an audit is worse than having no rule at all, because it stops someone from building the real one. The real control is the section above: do not grant ALL.

Editing sudoers safely

Configuration changevisudo -c— visudo -c -f FILE validates FILE against the sudoers grammar without saving. Use this in CI and pre-deploy hooks to catch syntax errors before they lock out root.

$ sudo visudo -c -f /etc/sudoers.d/myapp

/etc/sudoers.d/myapp: parsed OK

Illustrative output

Drop-in files

Place service-specific rules in /etc/sudoers.d/<name>. Each file must be owned by root, mode 0440. Files are parsed in lexical order; place general rules early, specific rules late.

Read-only / Safedrop-in files— Each drop-in is a complete sudoers fragment. The convention is one file per concern: myapp for the application's service rules, operators for human admins, breakglass for emergency access. Use version control to track changes.

$ ls -l /etc/sudoers.d/

-r--r----- 1 root root  450 Aug  9 11:11 /etc/sudoers.d/myapp
-r--r----- 1 root root  270 Aug  9 11:11 /etc/sudoers.d/operators
-r--r----- 1 root root  180 Aug  9 11:11 /etc/sudoers.d/breakglass

Illustrative output

The basic rule

Aliases

Defaults

Per-rule defaults

Least privilege: enumerate positively

Last match wins

Negation and exceptions

Editing sudoers safely

Drop-in files

Knowledge check