Bugzilla – Bug 264
visudo doesn't verify permissions of sudoers file
Last modified: 2008-11-09 15:21:11 MST
Main issue: The visudo -c -s -f check should ensure that the file which is about to replace sudoers will have no issues whatsoever when accessed by sudo. i.e. any requirements sudo has on /etc/sudoers must be reflected and verified with visudo, this is not the case. Specific fail case: sudo will fail if the /etc/sudoers file's permissions are not set to 440, which is potentially disastrous in ubuntu since the root account is locked and the only way to edit /etc/sudoers is through sudo -s. Thus if you make this mistake, you have to rescue the system. If this is a requirement of the /etc/sudoers file, and if this means that sudo will not run without it, then visudo should detect this issue, but it doesn't. Running "visudo -c -s -f <file>" on a sudoers file that has permissions other than 440 returns no error.
visudo in sudo 1.7.0 will check the owner and mode on the sudoers file in -c mode if -s is specified. The change will be present in sudo 1.7.0rc4 to be released shortly.