When I type "sudo some_command", the terminal shows:

sudo: unable to stat /etc/sudoers: Permission denied
sudo: no valid sudoers sources found, quitting
sudo: unable to initialize policy plugin

my account is an admin account, and the /etc/sudoers contains:

root        ALL = (ALL) ALL
%admin      ALL = (ALL) ALL

How to fix this?

  • 1
    Please add the output of ls -l /etc/sudoers
    – nohillside
    Jan 11, 2017 at 15:34
  • @patrix the output is -r--r-----+ 1 root wheel 1563 Jan 11 10:42 /etc/sudoers Jan 11, 2017 at 15:40
  • 1
    Uhh, ls -le /etc/sudoers and ls -led /etc as well then, please
    – nohillside
    Jan 11, 2017 at 16:47
  • @patrix -rw-rw-r--+ 1 root wheel 1563 Jan 11 10:42 /etc/sudoers 0: group:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity and lrwxr-xr-x@ 1 root wheel 11 Dec 10 21:13 /etc -> private/etc Jan 12, 2017 at 1:29
  • Did it ever work? The ACL seems a bit strange (I don't have one on this file), but I'm not sure whether this causes any issues (and am reluctanct to try it here).
    – nohillside
    Jan 12, 2017 at 16:26

2 Answers 2


Open up Terminal and enable root with:

dsenableroot -u <your_admin_username> -p <your_password> -r <root_password> #choose some root password here 

If the sudoer's is damaged, you still won't be able to sudo - but you will be able to su and repair the permissions accordingly:

su #when asked afterwards enter the above <root_password>
chown root:wheel /etc/sudoers
chmod 440 /etc/sudoers
chmod -a "admin allow read,write,append,readattr,writeattr,readextattr,writeextatt‌​r,readsecurity" /etc/sudoers

Back in your admin account disable root:

dsenableroot -d -u <your_admin_username> -p <your_password>

In case the above won't help, re-enable root account doing the same as above, logut of your account, login as root (yup, really):

Open terminal and type chmod g+x /, close the term, logout and tada, sudo is working again :) This problem happens mostly when you mount your / through linux in rw mode (for hfsplus in r/w mode use fuse and bindfs)

BTW the group admin ACL doesn't seem to harm the sudoers file!

  • 2
    Better boot into single user mode for this no need to enable root
    – mmmmmm
    Apr 10, 2017 at 9:40
  • And do what from the single user login exactly? You need to know how to move around launchctl/diskarbitrioned (since you are in ro mount) and doing mount -rw / and then visudo won't solve this.
    – PJJ
    Apr 10, 2017 at 10:23
  • @mark Might be worth another answer then
    – nohillside
    Apr 10, 2017 at 10:57
  • 1
    @PJJ OK I heavily modified your answer ;-) - but after the second dsenableroot line you shouldn't be able to login as root. You either have to run chmod g+x / in su mode or you have to move your last sentence in front of the 2nd dsenableroot line. Also: this shouldn't be necessary in Sierra!
    – klanomath
    Apr 10, 2017 at 11:15
  • True, true, overseen that- modded hopefully that won't be all too confusing ;) - most of the times it's chmod g+x / since h4x0rs confuse darwin with linux and map happily their guids over darwins realizing later that in darwin guids start from 500 instead of 1000 ;)
    – PJJ
    Apr 10, 2017 at 11:20

Here is a high-level steps:

$ dsenableroot -u <user-username> -p <your-user-password> -r <new-password-for-root>

Then create a backup of the sudoers file and edit

$ su
sh-3.2# cp /etc/sudoers /etc/sudoers.bak
sh-3.2# vi /etc/sudoers.bak
sh-3.2# cp /etc/sudoers.bak /etc/sudoers
sh-3.2# exit

Last disable root access:

$ dsenableroot -d -u abdi -p <root-password>
dsenableroot:: ***Successfully disabled root user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .