To run programs as sudo without password, I edited /etc/sudoers with wrong content.

Then I re-edited it with Mac's default text editor(course sudo cannot be used when /etc/sudoers is wrong).

I tried to run sudo agin, and get this error:

sudo: /etc/sudoers is owned by uid 501, should be 0
sudo: no valid sudoers sources found, quitting

What should I do? I cannot remember the root password (maybe I haven't ever set root password before).

  • Dose Disk Utilities repair permissions work? – mmmmmm Nov 23 '14 at 11:53
  • @Mark how to do that? I'm using Chinese version. – kxxoling Nov 23 '14 at 11:56
  • @Mark It works, but got syntax error now. – kxxoling Nov 23 '14 at 12:00
  • I repaired the error in sudoers file, then repaired the permissions agin. it's alright now. Thanks a lot @Mark – kxxoling Nov 23 '14 at 12:13
  • @Mark Answer my question, and I will choose you as the accepted one. – kxxoling Nov 23 '14 at 12:19

You can boot into single user mode by pressing Cmd-S on startup (see OS X: How to start up in single-user or verbose mode for details) which should give you a root shell. Then run

mount -uw /
chown root:wheel /etc/sudoers
chmod 440 /etc/sudoers

to fix the problem and restart.

| improve this answer | |
  • 1
    Just to save others some of the time I wasted fooling around with the sudoers file, The permissions MUST be 440, and the owners MUST be root:wheel. Anything else will cause sudo to fail. Don't try and get clever with symbolic links! -r--r----- 1 root wheel – Sridhar Sarnobat Mar 13 '16 at 20:31
  • worked, I <3 u @patrix. This the only one that worked for me, I'm on Sierra all other things in all sites didn't worked for me. – Julio Marins Dec 25 '16 at 15:42
  • 1
    right after mount run: chown 0 /private/etc/sudoers – Maksim Kostromin Jul 27 '18 at 10:02
  • @MaksimKostromin What's the reason to run this? – nohillside Jul 27 '18 at 13:34
  • 1
    reason to do so, because it will fix subject issue. it's enough and I just did it – Maksim Kostromin Jul 27 '18 at 14:05

Yosemite and earlier OSX keeps info on what permissions system files (i.e. files the OS installs) should be. Apple's doc

To restore this use Disk Utility.app.
Select the boot volume (by default called Macintosh HD) on the left hand side.
Click the Verify or Repair Disk Permissions - the latter will reapply the stored permissions.

To edit sudoers in the future I would use visudo which checks that the edit is valid

re the root password you probably have not set it before - the idea of sudo is that you never need to use it and Apple disables root login by default

| improve this answer | |
  • 6
    there is no such thing on sierra anymore – Julio Marins Dec 25 '16 at 14:04
  • 1
    That doesn't work with OS X El Capitan – zok May 11 '17 at 8:44
  • I think we need update somehow that thread to correct answer from for example next post – Maksim Kostromin Jul 28 '18 at 0:02
  • 1
    macOS mojave does not have this anymore. What's the fix now? – andrea Jan 1 '19 at 23:55
  • @andrew see comments above yours and thus try apple.stackexchange.com/a/157775/237 – mmmmmm Jan 1 '19 at 23:57

For macOS Mojave, here is what worked for me:

  1. Start up in recovery mode (Cmd+R during boot up)
  2. Disk Utilities > Select Macintosh HD, and Mount
  3. Close Disk Utilities
  4. Utilities > Terminal
  5. Type: chown root:wheel "/Volumes/Macintosh HD/etc/sudoers"
  6. Reboot

You may also need to change the ownership of ts, back in the Terminal:

sudo su
sudo chown -R root:wheel /var/db/sudo/ts/
| improve this answer | |
  • 1
    Why do you reboot the machine afterwards? And also, why are you doing sudo su? – bot47 Sep 23 '19 at 6:15
  1. Open Directory Utility (/System/Library/CoreServices/).
  2. Click the lock icon to unlock it, then enter your administrator name and password.
  3. Do one of the following:

    • Choose Edit > Enable Root User, then enter a root user password in the Password and Verify fields.
    • Choose Edit > Change Root Password, then enter a new root user password. You don't need an old password
  4. Login to Root
  5. Modify sudoers with visudo like stated in the file:

    The original file looks like this:

    # sudoers file.
    # This file MUST be edited with the 'visudo' command as root.
    # Failure to use 'visudo' may result in syntax or file permission errors
    # that prevent sudo from running.
    # See the sudoers man page for the details on how to write a sudoers file.
    # Host alias specification
    # User alias specification
    # Cmnd alias specification
    # Defaults specification
    Defaults    env_reset
    Defaults    env_keep += "BLOCKSIZE"
    Defaults    env_keep += "COLORFGBG COLORTERM"
    Defaults    env_keep += "__CF_USER_TEXT_ENCODING"
    Defaults    env_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME"
    Defaults    env_keep += "LINES COLUMNS"
    Defaults    env_keep += "LSCOLORS"
    Defaults    env_keep += "SSH_AUTH_SOCK"
    Defaults    env_keep += "TZ"
    Defaults    env_keep += "EDITOR VISUAL"
    Defaults    env_keep += "HOME MAIL"
    # Runas alias specification
    # User privilege specification
    root    ALL=(ALL) ALL
    %admin  ALL=(ALL) ALL
    # Uncomment to allow people in group wheel to run all commands
    # %wheel    ALL=(ALL) ALL
    # Same thing without a password
    # %wheel    ALL=(ALL) NOPASSWD: ALL
    # Samples
    # %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
    # %users  localhost=/sbin/shutdown -h now


    machine:~ user$ ls -l /private/etc/sudoers 
    -r--r-----  1 root  wheel  1275 13 Jun  2012 /private/etc/sudoers

    Using visudo to modify the file corrects file permissions automatically

  6. Disable the root user again.

| improve this answer | |
  • If you find that you can't edit the file through the command line, open it using a GUI application like TextEdit. That will bypass the corrupt sudo configuration. – Sridhar Sarnobat Mar 13 '16 at 9:45

Great and simply for High Sierra- no SUDO, no recovery, just (verify/repair permissions)

  1. First Step
diskutil resetUserPermissions / `id -u`
  1. Second item Choose Folder via Finder -> Information -> unlock and choose Setting Wheel on the bottom-> Apply to enclosed Items



| improve this answer | |
  • So in simple words, first make sure you have resetUserPermissions from the command line and then by going from Finder Go command move to /user/local/your_directory, right click and on gear icon add read-write permissions to your user. – Murtaza Khursheed Hussain Jul 10 '18 at 8:05
  • 1
    How does resetting user permissions fix issues with /etc/sudoers? – nohillside Jul 18 '18 at 6:10

In Terminal:

  1. Type sh or sudo sh (my case I accidentally set chown -R / so sudo is me, no need sudo anymore, using sh)
  2. In sh, type cd /var/db/sudo/, then do ls -ln to check if its the same as these:

    total 0
    drwxr-xr-x  2 501  0   68 Oct 23 23:56 yourusername
    drwx------  3 501  0  102 Nov 24 00:57 ts
  3. then type ls -la and you'll get these:

    total 0
    drwx--x--x   4 yourusername   wheel   136 Oct 23 23:56 .
    drwxr-xr-x  80 yourusername   wheel  2720 Nov 24 01:55 ..
    drwxr-xr-x   2 root  wheel    68 Oct 23 23:56 yourusername
    drwx------   3 root  wheel   102 Nov 24 00:57 ts

The results above shows that yourusername is set to wheel, which isn't supposed to. It should normally look like these:

total 0
drwx--x--x   4 root  wheel   136 Oct 23 23:56 .
drwxr-xr-x  80 root  wheel  2720 Nov 24 01:55 ..
drwxr-xr-x   2 root  wheel    68 Oct 23 23:56 yourusername
drwx------   3 root  wheel   102 Nov 24 00:57 ts

See the difference?

Now, we want to fix it. Here's what I did:

  1. Still in sh, I typed chown -R root:wheel /var/db/sudo/yourusername to change it to UID 0 instead of UID 501 as above case
  2. Do the same for ts, chown -R root:wheel /var/db/sudo/ts/ Now check again the permission with ls -ln and it should look like these:

    total 0
    drwxr-xr-x  2 0  0   68 Oct 23 23:56 dan
    drwx------  3 0  0  102 Nov 24 00:57 ts
    UID is now set to 0 and not 501.
  3. Now we do the same for .. and . by running chown -R root:wheel /var/db/sudo/./ and then chown -R root:wheel /var/db/sudo/../, and you'll get results as No. 4 above.

Now we want to fix /etc/sudoers owned by UID 501.

  1. Still in sh, first check permission by running ls -ln /private/etc/sudoers and it should get this:

    -r--r-----  1 501  0  1563 Nov 14 17:53 /private/etc/sudoers

Notice the UID 501? We want it to become UID 0.

  1. So, run this command chown -R root:wheel /private/etc/sudoers and then ls -ln /private/etc/sudoers again to check if the permission changes to this:

    -r--r-----  1 0  0  1563 Nov 14 17:53 /private/etc/sudoers

So try sudo as you would again and see if that does the trick.

With all that, I have to remind you that I am not be responsible for your machine after following these steps, but at least this what works for me.

| improve this answer | |

If it still relevant this is my solution to this problem. I'm not doing boot into single user mode. It will work if you have the root password

su -
mount -uw /
chown root:wheel /etc/sudoers
chmod 440 /etc/sudoers
| improve this answer | |

This worked for me: (No root password, but admin access required)

  1. Created another admin account test
  2. Manually set it's uid to 0 (right click on account > Advanced Options)
  3. Restart the system, login via test (a lot of errors will pop-up, cancel/ok all of them)
  4. Go to cd /etc/ and chown -R $(whoami) sudoers (The sudo error will go away now, but removing test we have to undo everything)
  5. Restart the system and login with your normal account
  6. Manually set test uid to 502 (or 500+something that is not taken by other admins)
  7. Remove the test account
| improve this answer | |

You can fix this via AppleScript, without needing to reboot, or even log out & back in, or an existing root shell, or... All you need is a valid administrator password.

Run this command:

osascript -e 'do shell script "chown root:wheel /etc/sudoers; chmod 440 /etc/sudoers; chmod -N /etc/sudoers" with administrator privileges'

...and then authenticate as an administrator when requested.

Explanation: this is a bit indirect. It uses the shell command osascript to run a short AppleScript that uses the do shell script command to run a short shell script. The reason for the shell->AppleScript->shell thing is to use the with administrator privileges option, which has much the same effect as sudo but will work even if /etc/sudoers is completely messed up.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .