{
    "content": [
        {
            "type": "text",
            "text": "# visudo (man)\n\n## NAME\n\nvisudo — edit the sudoers file\n\n## SYNOPSIS\n\nvisudo [-chOPqsV] [[-f] sudoers]\n\n## DESCRIPTION\n\nvisudo edits the sudoers file in a safe fashion, analogous to vipw(8).  visudo locks the\nsudoers file against multiple simultaneous edits, performs basic validity checks, and checks\nfor syntax errors before installing the edited file.  If the sudoers file is currently being\nedited you will receive a message to try again later.\n\n## TLDR\n\n> Safely edit the sudoers file.\n\n- Edit the sudoers file:\n  `sudo visudo`\n- Check the sudoers file for errors:\n  `sudo visudo {{-c|--check}}`\n- Edit the sudoers file using a specific editor:\n  `sudo EDITOR={{editor}} visudo`\n- Display version:\n  `visudo {{-V|--version}}`\n\n*Source: tldr-pages*\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION** (9 subsections)\n- **ENVIRONMENT**\n- **FILES**\n- **DIAGNOSTICS**\n- **SEE ALSO**\n- **AUTHORS**\n- **CAVEATS**\n- **BUGS**\n- **SUPPORT**\n- **DISCLAIMER**\n- **Sudo 1.9.9                     January 20, 2022                     Sudo 1.9.9**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "visudo",
        "section": "",
        "mode": "man",
        "summary": "visudo — edit the sudoers file",
        "synopsis": "visudo [-chOPqsV] [[-f] sudoers]",
        "tldr_summary": "Safely edit the sudoers file.",
        "tldr_examples": [
            {
                "description": "Edit the sudoers file",
                "command": "sudo visudo"
            },
            {
                "description": "Check the sudoers file for errors",
                "command": "sudo visudo {{-c|--check}}"
            },
            {
                "description": "Edit the sudoers file using a specific editor",
                "command": "sudo EDITOR={{editor}} visudo"
            },
            {
                "description": "Display version",
                "command": "visudo {{-V|--version}}"
            }
        ],
        "tldr_source": "official",
        "flags": [
            {
                "flag": "-c",
                "long": "--check",
                "arg": null,
                "description": "Enable check-only mode. The existing sudoers file (and any other files it in‐ cludes) will be checked for syntax errors. If the path to the sudoers file was not specified, visudo will also check the file ownership and permissions (see the -O and -P options). A message will be printed to the standard output describing the status of sudoers unless the -q option was specified. If the check completes suc‐ cessfully, visudo will exit with a value of 0. If an error is encountered, visudo will exit with a value of 1."
            },
            {
                "flag": "-f",
                "long": "--file",
                "arg": null,
                "description": "Specify an alternate sudoers file location, see below. As of version 1.8.27, the sudoers path can be specified without using the -f option."
            },
            {
                "flag": "-h",
                "long": "--help",
                "arg": null,
                "description": ""
            },
            {
                "flag": "-O",
                "long": "--owner",
                "arg": null,
                "description": "Enforce the default ownership (user and group) of the sudoers file. In edit mode, the owner of the edited file will be set to the default. In check mode (-c), an error will be reported if the owner is incorrect. This option is enabled by de‐ fault if the sudoers file was not specified."
            },
            {
                "flag": "-P",
                "long": "--perms",
                "arg": null,
                "description": "Enforce the default permissions (mode) of the sudoers file. In edit mode, the per‐ missions of the edited file will be set to the default. In check mode (-c), an er‐ ror will be reported if the file permissions are incorrect. This option is enabled by default if the sudoers file was not specified."
            },
            {
                "flag": "-q",
                "long": "--quiet",
                "arg": null,
                "description": "Enable quiet mode. In this mode details about syntax errors are not printed. This option is only useful when combined with the -c option."
            },
            {
                "flag": "-s",
                "long": "--strict",
                "arg": null,
                "description": "Enable strict checking of the sudoers file. If an alias is referenced but not ac‐ tually defined or if there is a cycle in an alias, visudo will consider this a syn‐ tax error. Note that it is not possible to differentiate between an alias and a host name or user name that consists solely of uppercase letters, digits, and the underscore (‘’) character."
            },
            {
                "flag": "-V",
                "long": "--version",
                "arg": null,
                "description": "Print the visudo and sudoers grammar versions and exit. A sudoers file may be specified instead of the default, /etc/sudoers. The temporary file used is the specified sudoers file with “.tmp” appended to it. In check-only mode only, ‘-’ may be used to indicate that sudoers will be read from the standard input. Because the policy is evaluated in its entirety, it is not sufficient to check an individual sudoers include file for syntax errors."
            }
        ],
        "examples": [],
        "see_also": [
            {
                "name": "vi",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/vi/1/json"
            },
            {
                "name": "sudo.conf",
                "section": "5",
                "url": "https://www.chedong.com/phpMan.php/man/sudo.conf/5/json"
            },
            {
                "name": "sudoers",
                "section": "5",
                "url": "https://www.chedong.com/phpMan.php/man/sudoers/5/json"
            },
            {
                "name": "sudo",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/sudo/8/json"
            },
            {
                "name": "vipw",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/vipw/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 38,
                "subsections": [
                    {
                        "name": "-c --check",
                        "lines": 8,
                        "flag": "-c",
                        "long": "--check"
                    },
                    {
                        "name": "-f --file",
                        "lines": 3,
                        "flag": "-f",
                        "long": "--file"
                    },
                    {
                        "name": "-h --help",
                        "lines": 1,
                        "flag": "-h",
                        "long": "--help"
                    },
                    {
                        "name": "-O --owner",
                        "lines": 5,
                        "flag": "-O",
                        "long": "--owner"
                    },
                    {
                        "name": "-P --perms",
                        "lines": 5,
                        "flag": "-P",
                        "long": "--perms"
                    },
                    {
                        "name": "-q --quiet",
                        "lines": 3,
                        "flag": "-q",
                        "long": "--quiet"
                    },
                    {
                        "name": "-s --strict",
                        "lines": 6,
                        "flag": "-s",
                        "long": "--strict"
                    },
                    {
                        "name": "-V --version",
                        "lines": 8,
                        "flag": "-V",
                        "long": "--version"
                    },
                    {
                        "name": "Debugging and sudoers plugin arguments",
                        "lines": 30
                    }
                ]
            },
            {
                "name": "ENVIRONMENT",
                "lines": 9,
                "subsections": []
            },
            {
                "name": "FILES",
                "lines": 6,
                "subsections": []
            },
            {
                "name": "DIAGNOSTICS",
                "lines": 34,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "AUTHORS",
                "lines": 8,
                "subsections": []
            },
            {
                "name": "CAVEATS",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "BUGS",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "SUPPORT",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "DISCLAIMER",
                "lines": 5,
                "subsections": []
            },
            {
                "name": "Sudo 1.9.9                     January 20, 2022                     Sudo 1.9.9",
                "lines": 1,
                "subsections": []
            }
        ],
        "sections": {
            "NAME": {
                "content": "visudo — edit the sudoers file\n",
                "subsections": []
            },
            "SYNOPSIS": {
                "content": "visudo [-chOPqsV] [[-f] sudoers]\n",
                "subsections": []
            },
            "DESCRIPTION": {
                "content": "visudo edits the sudoers file in a safe fashion, analogous to vipw(8).  visudo locks the\nsudoers file against multiple simultaneous edits, performs basic validity checks, and checks\nfor syntax errors before installing the edited file.  If the sudoers file is currently being\nedited you will receive a message to try again later.\n\nvisudo parses the sudoers file after editing and will not save the changes if there is a syntax\nerror.  Upon finding an error, visudo will print a message stating the line number(s) where the\nerror occurred and the user will receive the “What now?” prompt.  At this point the user may\nenter ‘e’ to re-edit the sudoers file, ‘x’ to exit without saving the changes, or ‘Q’ to quit\nand save changes.  The ‘Q’ option should be used with extreme caution because if visudo be‐\nlieves there to be a syntax error, so will sudo.  If ‘e’ is typed to edit the sudoers file af‐\nter a syntax error has been detected, the cursor will be placed on the line where the error oc‐\ncurred (if the editor supports this feature).\n\nThere are two sudoers settings that determine which editor visudo will run.\n\neditor    A colon (‘:’) separated list of editors allowed to be used with visudo.  visudo will\nchoose the editor that matches the user's SUDOEDITOR, VISUAL, or EDITOR environment\nvariable if possible, or the first editor in the list that exists and is executable.\nNote that sudo does not preserve the SUDOEDITOR, VISUAL, or EDITOR environment vari‐\nables unless they are present in the envkeep list or the envreset option is dis‐\nabled in the sudoers file.  The default editor path is /usr/bin/editor which can be\nset at compile time via the --with-editor configure option.\n\nenveditor\nIf set, visudo will use the value of the SUDOEDITOR, VISUAL, or EDITOR environment\nvariables before falling back on the default editor list.  Note that visudo is typi‐\ncally run as root so this option may allow a user with visudo privileges to run arbi‐\ntrary commands as root without logging.  An alternative is to place a colon-separated\nlist of “safe” editors int the editor variable.  visudo will then only use\nSUDOEDITOR, VISUAL, or EDITOR if they match a value specified in editor.  If the\nenvreset flag is enabled, the SUDOEDITOR, VISUAL, and/or EDITOR environment vari‐\nables must be present in the envkeep list for the enveditor flag to function when\nvisudo is invoked via sudo.  The default value is on, which can be set at compile\ntime via the --with-env-editor configure option.\n\nThe options are as follows:\n",
                "subsections": [
                    {
                        "name": "-c --check",
                        "content": "Enable check-only mode.  The existing sudoers file (and any other files it in‐\ncludes) will be checked for syntax errors.  If the path to the sudoers file was not\nspecified, visudo will also check the file ownership and permissions (see the -O\nand -P options).  A message will be printed to the standard output describing the\nstatus of sudoers unless the -q option was specified.  If the check completes suc‐\ncessfully, visudo will exit with a value of 0.  If an error is encountered, visudo\nwill exit with a value of 1.\n",
                        "flag": "-c",
                        "long": "--check"
                    },
                    {
                        "name": "-f --file",
                        "content": "Specify an alternate sudoers file location, see below.  As of version 1.8.27, the\nsudoers path can be specified without using the -f option.\n",
                        "flag": "-f",
                        "long": "--file"
                    },
                    {
                        "name": "-h --help",
                        "content": "",
                        "flag": "-h",
                        "long": "--help"
                    },
                    {
                        "name": "-O --owner",
                        "content": "Enforce the default ownership (user and group) of the sudoers file.  In edit mode,\nthe owner of the edited file will be set to the default.  In check mode (-c), an\nerror will be reported if the owner is incorrect.  This option is enabled by de‐\nfault if the sudoers file was not specified.\n",
                        "flag": "-O",
                        "long": "--owner"
                    },
                    {
                        "name": "-P --perms",
                        "content": "Enforce the default permissions (mode) of the sudoers file.  In edit mode, the per‐\nmissions of the edited file will be set to the default.  In check mode (-c), an er‐\nror will be reported if the file permissions are incorrect.  This option is enabled\nby default if the sudoers file was not specified.\n",
                        "flag": "-P",
                        "long": "--perms"
                    },
                    {
                        "name": "-q --quiet",
                        "content": "Enable quiet mode.  In this mode details about syntax errors are not printed.  This\noption is only useful when combined with the -c option.\n",
                        "flag": "-q",
                        "long": "--quiet"
                    },
                    {
                        "name": "-s --strict",
                        "content": "Enable strict checking of the sudoers file.  If an alias is referenced but not ac‐\ntually defined or if there is a cycle in an alias, visudo will consider this a syn‐\ntax error.  Note that it is not possible to differentiate between an alias and a\nhost name or user name that consists solely of uppercase letters, digits, and the\nunderscore (‘’) character.\n",
                        "flag": "-s",
                        "long": "--strict"
                    },
                    {
                        "name": "-V --version",
                        "content": "Print the visudo and sudoers grammar versions and exit.\n\nA sudoers file may be specified instead of the default, /etc/sudoers.  The temporary file used\nis the specified sudoers file with “.tmp” appended to it.  In check-only mode only, ‘-’ may be\nused to indicate that sudoers will be read from the standard input.  Because the policy is\nevaluated in its entirety, it is not sufficient to check an individual sudoers include file for\nsyntax errors.\n",
                        "flag": "-V",
                        "long": "--version"
                    },
                    {
                        "name": "Debugging and sudoers plugin arguments",
                        "content": "visudo versions 1.8.4 and higher support a flexible debugging framework that is configured via\nDebug lines in the sudo.conf(5) file.\n\nStarting with sudo 1.8.12, visudo will also parse the arguments to the sudoers plugin to over‐\nride the default sudoers path name, user-ID, group-ID, and file mode.  These arguments, if\npresent, should be listed after the path to the plugin (i.e., after sudoers.so).  Multiple ar‐\nguments may be specified, separated by white space.  For example:\n\nPlugin sudoerspolicy sudoers.so sudoersmode=0400\n\nThe following arguments are supported:\n\nsudoersfile=pathname\nThe sudoersfile argument can be used to override the default path to the sudoers\nfile.\n\nsudoersuid=user-ID\nThe sudoersuid argument can be used to override the default owner of the sudoers\nfile.  It should be specified as a numeric user-ID.\n\nsudoersgid=group-ID\nThe sudoersgid argument can be used to override the default group of the sudoers\nfile.  It must be specified as a numeric group-ID (not a group name).\n\nsudoersmode=mode\nThe sudoersmode argument can be used to override the default file mode for the sudo‐\ners file.  It should be specified as an octal value.\n\nFor more information on configuring sudo.conf(5), please refer to its manual.\n"
                    }
                ]
            },
            "ENVIRONMENT": {
                "content": "The following environment variables may be consulted depending on the value of the editor and\nenveditor sudoers settings:\n\nSUDOEDITOR      Invoked by visudo as the editor to use\n\nVISUAL           Used by visudo if SUDOEDITOR is not set\n\nEDITOR           Used by visudo if neither SUDOEDITOR nor VISUAL is set\n",
                "subsections": []
            },
            "FILES": {
                "content": "/etc/sudo.conf            Sudo front-end configuration\n\n/etc/sudoers              List of who can run what\n\n/etc/sudoers.tmp          Default temporary file used by visudo\n",
                "subsections": []
            },
            "DIAGNOSTICS": {
                "content": "In addition to reporting sudoers syntax errors, visudo may produce the following messages:\n\nsudoers file busy, try again later.\nSomeone else is currently editing the sudoers file.\n\n/etc/sudoers: Permission denied\nYou didn't run visudo as root.\n\nyou do not exist in the passwd database\nYour user-ID does not appear in the system passwd database.\n\nWarning: {User,Runas,Host,Cmnd}Alias referenced but not defined\nEither you are trying to use an undeclared {User,Runas,Host,Cmnd}Alias or you have a\nuser or host name listed that consists solely of uppercase letters, digits, and the un‐\nderscore (‘’) character.  In the latter case, you can ignore the warnings (sudo will not\ncomplain).  The message is prefixed with the path name of the sudoers file and the line\nnumber where the undefined alias was used.  In -s (strict) mode these are errors, not\nwarnings.\n\nWarning: unused {User,Runas,Host,Cmnd}Alias\nThe specified {User,Runas,Host,Cmnd}Alias was defined but never used.  The message is\nprefixed with the path name of the sudoers file and the line number where the unused\nalias was defined.  You may wish to comment out or remove the unused alias.\n\nWarning: cycle in {User,Runas,Host,Cmnd}Alias\nThe specified {User,Runas,Host,Cmnd}Alias includes a reference to itself, either di‐\nrectly or through an alias it includes.  The message is prefixed with the path name of\nthe sudoers file and the line number where the cycle was detected.  This is only a warn‐\ning unless visudo is run in -s (strict) mode as sudo will ignore cycles when parsing the\nsudoers file.\n\nunknown defaults entry \"name\"\nThe sudoers file contains a Defaults setting not recognized by visudo.\n",
                "subsections": []
            },
            "SEE ALSO": {
                "content": "vi(1), sudo.conf(5), sudoers(5), sudo(8), vipw(8)\n",
                "subsections": []
            },
            "AUTHORS": {
                "content": "Many people have worked on sudo over the years; this version consists of code written primarily\nby:\n\nTodd C. Miller\n\nSee the CONTRIBUTORS file in the sudo distribution (https://www.sudo.ws/contributors.html) for\nan exhaustive list of people who have contributed to sudo.\n",
                "subsections": []
            },
            "CAVEATS": {
                "content": "There is no easy way to prevent a user from gaining a root shell if the editor used by visudo\nallows shell escapes.\n",
                "subsections": []
            },
            "BUGS": {
                "content": "If you feel you have found a bug in visudo, please submit a bug report at\nhttps://bugzilla.sudo.ws/\n",
                "subsections": []
            },
            "SUPPORT": {
                "content": "Limited free support is available via the sudo-users mailing list, see\nhttps://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search the archives.\n",
                "subsections": []
            },
            "DISCLAIMER": {
                "content": "visudo is provided “AS IS” and any express or implied warranties, including, but not limited\nto, the implied warranties of merchantability and fitness for a particular purpose are dis‐\nclaimed.  See the LICENSE file distributed with sudo or https://www.sudo.ws/license.html for\ncomplete details.\n",
                "subsections": []
            },
            "Sudo 1.9.9                     January 20, 2022                     Sudo 1.9.9": {
                "content": "",
                "subsections": []
            }
        }
    }
}