2

I have a weird issue with my Raspberry pi - sudo has stopped working. Every time I try to run a command using sudo, i get this:

sudo: error in /etc/sudo.conf, line 0 while loading plugin `sudoers_policy'
sudo: unable to load /usr/lib/sudo/sudoers.so: (null) 
sudo: fatal error, unable to load plugins

Commands without sudo seem to work okay. The file /etc/sudo.conf doesn't exist at all.

This is the system info:

Linux raspberrypi 4.4.21-v7+ #911 SMP Thu Sep 15 14:22:38 BST 2016 armv7l GNU/Linux

Is there a way of fixing this, ideally without formatting the SD card/reinstalling?

  • Does /usr/lib/sudo/sudoers.so exist on your system? – Steve Robillard Jan 4 '17 at 17:34
  • Yeah, that exists. – Peconia Jan 4 '17 at 17:35
  • What are the permissions? – Steve Robillard Jan 4 '17 at 17:35
  • -rw-r--r-- 1 root root 308944 Jan 11 2016 /usr/lib/sudo/sudoers.so – Peconia Jan 4 '17 at 17:35
  • 1
    IIRC you should have full access if you put the card in a Linux box. – Steve Robillard Jan 4 '17 at 18:45
1

You specified in your question that /etc/sudo.conf does not exist, but I don't think it's supposed to. If /etc/sudoers does not exist, however, you need one. You can recreate it by putting the SD card into a linux computer and using a text editor as root to fill in the basics:

Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
root    ALL=(ALL:ALL) ALL
%sudo   ALL=(ALL:ALL) ALL
pi ALL=(ALL) NOPASSWD: ALL

If you have an original copy somewhere, you could copy that in place.

Update

Fabian makes a good point in the comments. If you create the file, the permissions need to be correct. When I create the file as root, the default permissions don't allow access to anyone except root's user and group, but the default file has slightly more restrictive permissions. The example below needs to be corrected for wherever the sudoers file is located, or just do this as root after booting back up:

chmod 440 /etc/sudoers

The file should also be owned by root, so if it isn't (for some strange reason) execute this command in the environment and as root:

chown root:root /etc/sudoers
  • addition: permissions of /etc/sudoers should be -r--r----- 1 root root – Fabian Sep 25 '18 at 9:20
1

I get the same matter. The way to resolve the problem is to use the other linux to fix the owner.

For example, you have a ubuntu as a virtual machine on your computer(MacOS or Windows it doesn't matter.) If you have the other raspberry, it is right for this working. You need to use a USB adapter for your micro sd card which is your "pi".

Then, plug the "pi" to your linux machine. Execute the cli df -h. You see the /media or /dev in front of you.

Go into it, cd /media or cd /dev. Perhaps, your pi not having the machine name, it may be as a series of number to represent your /boot and /. (Don't go to the wrong way, go to /. My operation is on virtual machine, ubuntu and the name is /media/virtuallmachine/mypie.)

The last name mypie is your "pi" machine name. If you haven't name it, the long number is to replace the name of it.

Run cd /media/virtuallmachine/mypie and then run ls. You can see the all of directories about /. (i.e. etc, usr, var, home, dev and media..etc..)

pi@retropie:/usr/lib/sudo $ ls -alh
total 472K
drwxr-xr-x  2 root root 4.0K Mar 14  2018 .
drwxr-xr-x 85 root root 4.0K Dec  8 10:29 ..
-rw-r--r--  1 root root  915 Jun  5  2017 group_file.la
-rw-r--r--  1 root root 9.4K Jun  5  2017 group_file.so
-rw-r--r--  1 root root  936 Jun  5  2017 libsudo_util.la
lrwxrwxrwx  1 root root   21 Jun  5  2017 libsudo_util.so -> libsudo_util.so.0.0.0
lrwxrwxrwx  1 root root   21 Jun  5  2017 libsudo_util.so.0 -> libsudo_util.so.0.0.0
-rw-r--r--  1 root root  78K Jun  5  2017 libsudo_util.so.0.0.0
-rwxr-xr-x  1 root root  14K Jun  5  2017 sesh
-rw-r--r--  1 root root  897 Jun  5  2017 sudoers.la
-rw-r--r--  1 root root 319K Jun  5  2017 sudoers.so
-rw-r--r--  1 root root  920 Jun  5  2017 sudo_noexec.la
-rw-r--r--  1 root root 5.3K Jun  5  2017 sudo_noexec.so
-rw-r--r--  1 root root  927 Jun  5  2017 system_group.la
-rw-r--r--  1 root root 5.4K Jun  5  2017 system_group.so
pi@retropie:/usr/lib/sudo $ 

If you know regex, you can quickly to change the permission. The command line is this-find . -name "*\.so*" -o -name "*\.la"". This is output under below.

pi@retropie:/usr/lib/sudo $ find . -name "*\.so*" -o -name "*\.la"
./group_file.la
./system_group.so
./sudo_noexec.la
./libsudo_util.so
./sudo_noexec.so
./sudoers.la
./libsudo_util.so.0.0.0
./libsudo_util.la
./libsudo_util.so.0
./sudoers.so
./system_group.la
./group_file.so
pi@retropie:/usr/lib/sudo $

The next step is to execute find . -name "*\.so*" -o -name "*\.la" -exec chmod 644 {} \;. This is a way to change all file having ".so"(including a ".so" with or without those tailing characters.) or ".la". Behind -exec, it is the command such as cp, mv, cat or others. The curly brace {} and \; must be with this command line(cli) for executing. Without them, it can not be executed. Why? Just Google it.

A site is for practicing regex. (Plus a book or site much better for learning.) https://www.regexpal.com

==================================================================================

Above the article, it is enough for you to handle your matter.

Under below, I wonder why I get this matter.(It's able to be ignored.)

This path /usr/lib had been changed to its owner pi:pi. If your pi machine has this situation, it is needed to be change to root:root.

Under the path-/usr/lib/, there are many user library. My situation is all of them being changed to pi:pi. So, it should be changed back to root:root.

pi@retropie:/usr $ ls -alh
total 104K
drwxr-xr-x  10 root root  4.0K Mar 14  2018 .
drwxr-xr-x  21 root root  4.0K Dec 18 13:56 ..
drwxr-xr-x   2 root root   48K Dec 25 15:16 bin
drwxr-xr-x   2 root root  4.0K Dec  2 16:31 games
drwxr-xr-x  94 root root   12K Dec  8 10:33 include
drwxr-xr-x  85 pi   pi    4.0K Dec  8 10:29 lib
drwxrwsr-x  10 root staff 4.0K Dec  6 15:42 local
drwxr-xr-x   2 root root   12K Dec 17 18:32 sbin
drwxr-xr-x 220 root root  4.0K Dec 13 10:14 share
drwxr-xr-x   7 root root  4.0K Dec  8 10:54 src
pi@retropie:/usr $ 

Why I get the matter? I am specious on a way I had run "find /home/pi -type f -group pi -exec chmod 700 {} \;" and "find /home/pi -type d -group pi -exec chmod 700 {} \;". This way is to make my /home/pi to be limit their rwx permission.

The other way is to change /etc/fstab to add a line #PARTUUID=14a75fe9-02 /home/pi/myweb ext4 defaults,acl 1 2 for acl.

About acl:

https://sites.google.com/site/itmyshare/system-admin-tips-and-tools/acl-on-linux----setfacl-examples

https://www.computerhope.com/unix/ugetfacl.htm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.