Bsrgvty

At the moment I'm working on a solution to prevent all admins users (except one particular) from running sudo. I can add a specific user to sudoers by running:

sudo -i
echo '$username ALL=(ALL:ALL) ALL' >> /etc/sudoers

Then I'd like to remove %admin ALL = (ALL) ALL within sudoers file which would just leave the above admin as the only sudo admin. However I cannot seem to find a way on how to remove/replace a particular string within sudoers.

I'd like to make this into a script hence using visudo and manually adjusting won't work for me. If there a way to run visudo from script and adjust a particular line within sudoers that would be ideal, but I couldn't find anything when researching on the Web.

I've seen a solution here:

• https://www.ibm.com/developerworks/community/blogs/brian/entry/edit_sudoers_file_from_a_script4?lang=en

which works in Linux. Is it possible to make it work in macOS?

Here's an alternate method. Lines are not added or deleted from the sudoers file. The line giving admin root rights is commented out and we create a separate file with mac_admin's rights in the directory /etc/sudoers.d. And as a bonus, the original sudoers file is backed up.

printf '%sn' 'mac_admin ALL=(ALL:ALL) ALL' > /tmp/99-macadmin

visudo -c -f /tmp/99-macadmin &&
install -o 0 -g 0 -m 440 /tmp/99-macadmin /etc/sudoers.d

sed $'s/%admint/# %admin/' /etc/sudoers > /tmp/sudoers

visudo -c -f /tmp/sudoers &&
install -B .orig -b -o 0 -g 0 -m 440 /tmp/sudoers /etc/sudoers

rm /tmp/sudoers /tmp/99-macadmin

For what it's worth, you can use

printf '/^%%admin ALL = (ALL) ALL$/dnwnqn' | ed -s sudoers

or, if you want to catch the line independent of the number of space characters, tabs etc used

printf '/^%%admin[[:blank:]]*ALL[[:blank:]]*=[[:blank:]]*(ALL)[[:blank:]]*ALL$/dnwnqn' | ed sudoers 

in bash to remove the admin line (the double %% are required to prevent printf from interpreting them as formatting instructions).

The usual caveats about editing sudoers without relying on the syntax checks done by visudo apply. So it might be safer to run the following, or at least have another root shell running so you can fix any issues without getting locked out)

cp /etc/sudoers /tmp
chmod +w /tmp/sudoers
printf '/^%%admin[[:blank:]]*ALL[[:blank:]]*=[[:blank:]]*(ALL)[[:blank:]]*ALL$/dnwnqn' 
 | ed /tmp/sudoers
if visudo -c -f /tmp/sudoers; then
 echo "All well"
 mv -f /tmp/sudoers /etc/sudoers
 chmod -w /etc/sudoers
else
 echo "Uups, something went wrong"
fi

(Script untested, because I don't want to mess with my sudoers file)

Amazing! It worked! Thank you very much! @nohillside

I'll add a line above that to add a user mac_admin before the script executes so the final version should look like this.

echo 'mac_admin ALL=(ALL:ALL) ALL' >> /etc/sudoers

cp /etc/sudoers /tmp
chmod +w /tmp/sudoers
printf '/^%%admin.*ALL = (ALL) ALL$/dnwnqn' | ed /tmp/sudoers
if visudo -c -f /tmp/sudoers; then
 echo "All well"
 mv -f /tmp/sudoers /etc/sudoers
 chmod -w /etc/sudoers
else
 echo "Uups, something went wrong"
fi

Just FYI I am running this script by scoping it to my machine on Jamf Pro so it excecutes via a recurring check-in policy.