sudo: /private/etc/sudoers.d is owned by uid 501 should be 0 - unable to run sudo commands on terminal (macOS Big Sur 11.3.1)

Question

When I Run Any Sudo Commands I get:

sudo: /private/etc/sudoers.d is owned by uid 501, should be 0

sudo: no valid sudoers sources found, quitting

sudo: error initializing audit plugin sudoers_audit

This behavior starts at a failed mongodb installation and increased by the last 11.3.1 big sur update. Several Apps Crashing. I did a little research and some people recommends starts in safe mode and run:

chown root:wheel /etc/sudoers

But i forgotten (by now) the firmware password. So when i try to run any init shortcut prompts for the firmware password.

This script works for me to have sudo commands but only when its running:

do shell script "chown root:wheel /etc/sudoers; chmod 440 /etc/sudoers; chmod -N /etc/sudoers" with administrator privileges

would this command fix it? : sudo chown -R root:wheel /private/etc/sudoers.d

HELP!

Answer 1

Yes, as long as sudo is allowing you to run commands as root, you should be able to fix the ownership of /etc/sudoers.d with:

sudo chown -R root:wheel /private/etc/sudoers.d

I'd also recommend cleaning up the permissions on it and its contents, in case they're also messed up:

sudo chmod -N /private/etc/sudoers.d
sudo chmod 755 /private/etc/sudoers.d

If there are any files in /private/etc/sudoers.d, you should fix their perms as well:

sudo chmod 440 /private/etc/sudoers.d/*

(Note: if there aren't any files in /private/etc/sudoers.d, that last command will give you a "No such file or directory" error, but won't do any harm. So if you're not sure if there are any files there, go ahead and run it just in case.)

Concerning the lost firmware password: on modern Macs, there's no way to reset or bypass this without Apple's help, and it's going to limit what you can do with the Mac until you get it fixed. I'd recommend getting in touch with either Apple or an Apple-Authorized Service Provider about having it reset. I'm not familiar with the current procedures, but I'm pretty sure you'll have to provide proof that you own the Mac in question before they'll reset the firmware PW for you.