6

I have a user user1 that is not in the sudoers file (nor belonging to groups in sudoer) but can still use sudo. How is it possible ?

user1~$ groups
        user1 www-data

My sudoer conf

        root ALL=(ALL) ALL
        %sudo ALL=(ALL) ALL

        #includedir /etc/sudoers.d

user1~$ sudo -l
        User user1 may run the following commands on this host:
        (ALL) ALL

2 Answers 2

17

As you can see, your sudoers file contains a line above which includes a number of other files from /etc/sudoers.d. You may be thinking that the hash symbol in front is a comment, but from man sudoers:

It is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives.

You will need to show us the contents of all files in /etc/sudoers.d/ before we can comment on why user1 has sudo privileges.

7
  • Thanks, I was sure it was commented out ! There is effectively files in sudoers.d that define additionial rights.
    – Go4It
    Feb 12, 2014 at 10:48
  • 9
    Whoever thought of using # like that in a config file where a # in all bar one other context means a comment needs a good talking to.
    – user9517
    Feb 12, 2014 at 10:49
  • 3
    <grin> I agree, but things are even worse: it has another non-comment use: "The pound sign (‘#’) is used to indicate a comment (unless it is part of a #include directive or unless it occurs in the context of a user name and is followed by one or more digits, in which case it is treated as a uid)". Bring forth the cluebat!
    – MadHatter
    Feb 12, 2014 at 10:53
  • 2
    #include is a C-ism. It's not a comment there :)
    – Bill Weiss
    Feb 12, 2014 at 12:39
  • 4
    @BillWeiss: I know #include from C but not in a config file where # is a comment ... it's just wrong
    – user9517
    Feb 12, 2014 at 14:23
-1

There is a group named "sudo"; execute sudo /cat/group in terminal and watch output, user1 should be included in the group at installation time.

3
  • The command groups in the OP shows that the user is only in one group, www-data. Feb 15, 2023 at 6:55
  • It is a fresh install without root user
    – Rocdufer
    Feb 16, 2023 at 6:47
  • In my system groups user-i returns this output: user-i : user-i cdrom floppy sudo audio dip video plugdev netdev lpadmin scanner
    – Rocdufer
    Feb 16, 2023 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .