11

My user account is a standard account on my Mac. What must I enter into Terminal using sudo, to make myself the administrator?

  • 1
    Is this about permanently changing your user account, or about running a terminal session with the rights of an admin (or root) user for which you know the logon info? – rackandboneman Dec 16 '15 at 11:19
14

If the actual user < user_name > has a standard account, you would have to enter

sudo dscl . -append /Groups/admin GroupMembership <user_name>

to make < user_name > an admin.

Only a restricted number of users are sudoers (i.e. accounts which are allowed to run su or sudo with root privileges successfully) though. The standard sudoers file (/etc/sudoers) in OS X looks like this:

...
# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel    ALL=(ALL) ALL
...

So only root and members of the admin group are allowed to run sudo by default. The above command run by < user_name > will fail consequently, because < user_name > isn't in the list.

To enable sudoing for < user_name >, you would have to add < user_name > to the list (below # User privilege specification) or uncomment the %wheel line with sudo visudo which has to be run by sudoers again (that's the Catch22 mentioned by Tetsujin).

  • 1
    Nicely specific to counter my 'wonderfully vague'. +1, as always. – Tetsujin Dec 15 '15 at 18:40
  • 1
    I don't recall: didn't the latest OSX rev. include some sort of "not-really-sudo" that lacks full standard Unix su rights? – Carl Witthoft Dec 16 '15 at 0:51
  • 3
    @CarlWitthoft Yep, you're probably thinking about SIP. – Deditos Dec 16 '15 at 13:03
12

That's a bit of a Catch22…

You need to already be an administrator to be on the sudoers list [with very few manually-changed exceptions]

Essentially, you cannot promote yourself.
That's the entire point of sudo & being an administrator, to be able to assign non-admins limited abilities.

-2

If you have access to an administrator account, you can become that account temporarily with:

su - <admin_username>

From there you can perform administrative actions via sudo.

If you do not have access to an administrator account, then there is no "sanctioned" way of getting admin access (since that's the whole point to having separate admin roles), but there are plenty of less-than-legitimate ways of attaining it, such as privilege escalation exploits or booting into single-user mode. (These will be left as an exercise to the reader.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .