2

When I type "sudo some_command", the terminal shows:

sudo: unable to stat /etc/sudoers: Permission denied
sudo: no valid sudoers sources found, quitting
sudo: unable to initialize policy plugin

my account is an admin account, and the /etc/sudoers contains:

root        ALL = (ALL) ALL
%admin      ALL = (ALL) ALL

How to fix this?

  • 1
    Please add the output of ls -l /etc/sudoers – nohillside Jan 11 '17 at 15:34
  • @patrix the output is -r--r-----+ 1 root wheel 1563 Jan 11 10:42 /etc/sudoers – Desmond Chen Jan 11 '17 at 15:40
  • 1
    Uhh, ls -le /etc/sudoers and ls -led /etc as well then, please – nohillside Jan 11 '17 at 16:47
  • @patrix -rw-rw-r--+ 1 root wheel 1563 Jan 11 10:42 /etc/sudoers 0: group:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity and lrwxr-xr-x@ 1 root wheel 11 Dec 10 21:13 /etc -> private/etc – Desmond Chen Jan 12 '17 at 1:29
  • Did it ever work? The ACL seems a bit strange (I don't have one on this file), but I'm not sure whether this causes any issues (and am reluctanct to try it here). – nohillside Jan 12 '17 at 16:26
6

Open up Terminal and enable root with:

dsenableroot -u <your_admin_username> -p <your_password> -r <root_password> #choose some root password here 

If the sudoer's is damaged, you still won't be able to sudo - but you will be able to su and repair the permissions accordingly:

su #when asked afterwards enter the above <root_password>
chown root:wheel /etc/sudoers
chmod 440 /etc/sudoers
chmod -a "admin allow read,write,append,readattr,writeattr,readextattr,writeextatt‌​r,readsecurity" /etc/sudoers
exit

Back in your admin account disable root:

dsenableroot -d -u <your_admin_username> -p <your_password>

In case the above won't help, re-enable root account doing the same as above, logut of your account, login as root (yup, really):

Open terminal and type chmod g+x /, close the term, logout and tada, sudo is working again :) This problem happens mostly when you mount your / through linux in rw mode (for hfsplus in r/w mode use fuse and bindfs)


BTW the group admin ACL doesn't seem to harm the sudoers file!

  • 2
    Better boot into single user mode for this no need to enable root – Mark Apr 10 '17 at 9:40
  • And do what from the single user login exactly? You need to know how to move around launchctl/diskarbitrioned (since you are in ro mount) and doing mount -rw / and then visudo won't solve this. – PJJ Apr 10 '17 at 10:23
  • @mark Might be worth another answer then – nohillside Apr 10 '17 at 10:57
  • 1
    @PJJ OK I heavily modified your answer ;-) - but after the second dsenableroot line you shouldn't be able to login as root. You either have to run chmod g+x / in su mode or you have to move your last sentence in front of the 2nd dsenableroot line. Also: this shouldn't be necessary in Sierra! – klanomath Apr 10 '17 at 11:15
  • True, true, overseen that- modded hopefully that won't be all too confusing ;) - most of the times it's chmod g+x / since h4x0rs confuse darwin with linux and map happily their guids over darwins realizing later that in darwin guids start from 500 instead of 1000 ;) – PJJ Apr 10 '17 at 11:20
0

Here is a high-level steps:

$ dsenableroot -u <user-username> -p <your-user-password> -r <new-password-for-root>

Then create a backup of the sudoers file and edit

$ su
Password:<your-new-root-password>
sh-3.2# cp /etc/sudoers /etc/sudoers.bak
sh-3.2# vi /etc/sudoers.bak
sh-3.2# cp /etc/sudoers.bak /etc/sudoers
sh-3.2# exit

Last disable root access:

$ dsenableroot -d -u abdi -p <root-password>
dsenableroot:: ***Successfully disabled root user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .