Why is visudo the recommended way to edit /etc/sudoers rather than opening the file directly in an editor?
LPIC-1 Exam 102-500, objective 110. Security easy
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Not correct It is the only editor able to open a file owned by root with mode 0440.
Wrong. Any editor running as root can open and write that file; root is not stopped by the read-only mode bits.
Not correct It compiles /etc/sudoers into the binary format that sudo actually reads at runtime.
Wrong. There is no compiled form. sudoers stays a plain text file and sudo parses it on every invocation.
Correct It locks the file against simultaneous edits and refuses to install a version that fails its syntax check.
Correct. visudo takes a lock so two administrators cannot clobber each other, and it parses the result before saving. A syntax error in sudoers can lock everyone out of sudo, so this check is the whole point.
Not correct It signs the file with root's GPG key so that sudo can detect tampering.
Wrong. sudo performs no signature verification. It relies on the file being owned by root and not writable by anyone else, and refuses to run if the ownership or mode is wrong.
Why
visudo picks its editor from the SUDO_EDITOR, VISUAL or EDITOR variables, subject to the editor and env_editor settings in sudoers itself. `visudo -c` checks the syntax without editing, and `visudo -f /etc/sudoers.d/webteam` edits a drop-in file with the same locking and checking. Files under /etc/sudoers.d must also be root-owned and mode 0440.
Where this comes from
- Cited
- LPI exam objective 110.1
- What it says
- Configure sudo and edit /etc/sudoers safely.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked