Where Are Linux Sudo Permissions Configured?
Sudo permissions live in sudoers plus a drop-in directory, where one syntax slip locks out every admin.
Last updated
Root access policy fits in two places. The sudoers file sets defaults and includes a drop-in directory. Sudoers.d holds one file per rule set, letting packages and admins coexist without editing shared files.
Syntax errors here are total: sudo refuses everything until fixed, including the fix. Visudo exists solely to prevent that outcome by checking before writing. Permissions matter equally, with group writable files rejected outright.
Where Linux stores this, by platform
/etc/sudoers
Main policy plus #includedir for the drop-in dir. Edit only with visudo; a syntax error disables sudo system wide until recovery.
/etc/sudoers.d/
One file per custom rule with 0440 permissions. Files here override and extend the main policy without touching it.
Frequently asked questions
I broke sudoers and sudo rejects me. Now what?
Reboot to recovery or a root shell and fix the file from there. This is why servers keep a root password or console access. Prevention beats rescue: always edit with visudo, which syntax checks before saving.
Where do custom sudo rules go?
Drop files into sudoers.d with 0440 permissions and a #includedir line active. One file per purpose keeps packages and local rules from fighting. Never edit the directory's README into a rule.
Notice an outdated path? Let us know.