strang comment for /etc/sudoers.d

tranphat · 02-14-2017, 05:21 AM

Hi all,

I find that in my system, the information about the granting root privilege to ordinary users are put in the /etc/sudoers.d/ folder.

But when I read the /etc/sudoers file, I found this:

#includedir /etc/sudoers.d

so, the # sign here does not mean "comment out", right?

Please advise. It's so strang to me.

Turbocapitalist · 02-14-2017, 05:39 AM

The penultimate authority there is the manual page for sudoers. It is second only to the source code.

Code:

man sudoers

It states:

Code:

   Including other files from within sudoers
     It is possible to include other sudoers files from within the sudoers
     file currently being parsed using the #include and #includedir direc‐
     tives.

     This can be used, for ...

So what you see is the correct syntax for including other configuration files into sudoers. However, it does not explain why such a syntax is used or the etymology of such a syntax which might be your real question.

However, it does mean that you can put additional files in /etc/sudoers.d/ and, as long as they conform to sudoers syntax, they will be used. If they do not conform to the syntax, they will break sudo for you. The advantage of such files is that you can add and remove configurations in an automated manner, if so needed, without needing to parse or search the main configuration file.

hazel · 02-14-2017, 05:57 AM

It's commented out because, if it was active and there were actually no suitable files in sudoers.d, sudo would stop working! I remember a post here from someone who uncommented this line as an experiment; he couldn't use sudo afterwards and, as he was using a distro of the Ubuntu family, he couldn't easily correct his mistake either. To either correct sudoers or create files in sudoers.d, he needed sudo access...

"You can" in this context means you can in theory, not that you can with the default sudoers configuration.

Turbocapitalist · 02-14-2017, 06:00 AM

Quote:

Originally Posted by hazel

I remember a post here from someone who uncommented [sic] this line as an experiment; he couldn't use sudo afterwards...

That would be incorrect syntax to remove the pound sign from that directive. Getting locked out will happen with any other syntax error sudoers as well. In this particular case, the #include is the actual syntax, same for #includedir there.

r3sistance · 02-14-2017, 06:15 AM

sudoers already uses a lot of special characters, it could be that '#' was unusued and needed as prefix to separate it from other configuration, so that sudo isn't trying to assign things for the user include.

tranphat · 02-14-2017, 08:30 PM

Quote:

Originally Posted by Turbocapitalist

The penultimate authority there is the manual page for sudoers. It is second only to the source code.

Code:

man sudoers

It states:

Code:

   Including other files from within sudoers
     It is possible to include other sudoers files from within the sudoers
     file currently being parsed using the #include and #includedir direc‐
     tives.

     This can be used, for ...

So what you see is the correct syntax for including other configuration files into sudoers. However, it does not explain why such a syntax is used or the etymology of such a syntax which might be your real question.

However, it does mean that you can put additional files in /etc/sudoers.d/ and, as long as they conform to sudoers syntax, they will be used. If they do not conform to the syntax, they will break sudo for you. The advantage of such files is that you can add and remove configurations in an automated manner, if so needed, without needing to parse or search the main configuration file.

thank you for explaining. So in this case, it is the real syntax of sudoers file. Now I fully understand.

tranphat · 02-14-2017, 08:33 PM

Quote:

Originally Posted by r3sistance

sudoers already uses a lot of special characters, it could be that '#' was unusued and needed as prefix to separate it from other configuration, so that sudo isn't trying to assign things for the user include.

Can you please say a little bit more detail? Still not get your point for the sentence: it could be that '#' was ....."

r3sistance · 02-15-2017, 04:09 AM

I am saying that they probably needed a special character which could not be confused with being a group, a username or a command and given the normal usage of # as a comment, it could not be used in any.

Habitual · 02-15-2017, 07:08 AM

Quote:

Originally Posted by tranphat

so, the # sign here does not mean "comment out", right?
Please advise. It's so strang to me.

Incorrect. It mean you don't know what #comments are

The file is literally littered with comments.
https://gist.github.com/90f447357610...4d7e5fd43b950a

r3sistance · 02-15-2017, 07:15 AM

Quote:

Originally Posted by Habitual

Incorrect. It mean you don't know what #comments are

The file is literally littered with comments.
https://gist.github.com/90f447357610...4d7e5fd43b950a

Err, it also says "# does not mean comment" in regards to the lines the OP is talking about, Which are #include and #includedir, which are in fact, not comments despite appearing like them.

BW-userx · 02-15-2017, 08:46 AM

Quote:

Originally Posted by tranphat

Hi all,

I find that in my system, the information about the granting root privilege to ordinary users are put in the /etc/sudoers.d/ folder.

But when I read the /etc/sudoers file, I found this:

#includedir /etc/sudoers.d

so, the # sign here does not mean "comment out", right?

Please advise. It's so strang to me.

Does not your sudoer file have the included lines before that one line in question in your file?

Quote:

## Read drop-in files from /etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /etc/sudoers.d

that is an include command simular to a c file

Code:

#include <stdio.h>

Habitual · 02-15-2017, 10:16 AM

Quote:

Originally Posted by r3sistance

Err, it also says "# does not mean comment" in regards to the lines the OP is talking about, Which are #include and #includedir, which are in fact, not comments despite appearing like them.

I give up.
"commented directives"?

szboardstretcher · 02-15-2017, 10:22 AM

It should probably be mentioned that using 'visudo' is a good idea. It should catch any of your mistakes and keep you from writing a bad config. Don't edit sudoers by hand.

tranphat · 02-16-2017, 09:32 PM

Quote:

Originally Posted by BW-userx

Does not your sudoer file have the included lines before that one line in question in your file?

that is an include command simular to a c file

Code:

#include <stdio.h>

Hi, yes, it's my fault. I did not read carefully the instruction.
But by any way, it also surprises me, when # is usually used with meaning: "comment line".

BW-userx · 02-17-2017, 08:38 AM

Quote:

Originally Posted by tranphat

Hi, yes, it's my fault. I did not read carefully the instruction.
But by any way, it also surprises me, when # is usually used with meaning: "comment line".

yeah it threw me a little when I first seen that in sudoers file then read that line above it saying, ## (the '#' here does not indicate a comment), so I took its word for it and moved on.

I didn't put any reasoning or logic to it until this post showed up.