The Sudoers.d Trap That'll Waste an Hour of Your Life

If you've ever dropped a file into /etc/sudoers.d/ and watched your sudo rule quietly do nothing, you're not alone. This one trips up almost every Linux admin at least once.

The Problem

You add a rule like:

ALL ALL=(ALL) NOPASSWD: /usr/bin/systemctl status nginx

to /etc/sudoers.d/myapp, hit save, and... nothing changes. The user still gets prompted for a password. Or worse — sudo breaks entirely and you get:

sudo: unable to open /etc/sudoers.d/myapp: Permission denied

Two Things That Break It Every Time

1. File permissions

The file must be mode 0440 and owned by root:root. Any deviation and sudo ignores it silently.

chmod 0440 /etc/sudoers.d/myapp
chown root:root /etc/sudoers.d/myapp

2. Missing trailing newline

This one is absurd but real. sudoers files must end with a newline. If your editor strips it or you echo -n the last line, the entire file gets rejected. visudo will catch this. nano or cat >> often won't.

How to Actually Debug It

visudo -c checks all sudoers files for syntax errors:

# visudo -c
/etc/sudoers.d/myapp: wrong #! solver specifier, line 3 of...

That output tells you exactly which file and which line. Without -c you get nothing — it just silently skips the bad file.

The Habit

Always edit sudoers files with visudo -f /etc/sudoers.d/myapp instead of your editor of choice. It locks the file, validates syntax on save, and tells you immediately when something is wrong. It's the difference between a 5-second fix and a 45-minute incident.

This isn't a deep trick. It's just the thing nobody tells you until it costs you an afternoon.