{"record":{"id":"14df284bd9ff7252","repo":"lima-vm/lima","slug":"sudoers-file-q-is-out-of-sync-and-must-be-regene","errorCode":null,"errorMessage":"sudoers file %#q is out of sync and must be regenerated (Hint: %s)","messagePattern":"sudoers file %#q is out of sync and must be regenerated \\(Hint: (.+?)\\)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/networks/sudoers.go","lineNumber":118,"sourceCode":"\t\t// Default networks.yaml specifies /etc/sudoers.d/lima file. Don't throw an error when the\n\t\t// file doesn't exist, as long as password-less sudo still works.\n\t\tif errors.Is(err, os.ErrNotExist) {\n\t\t\terr = c.passwordLessSudo(ctx)\n\t\t\tif err == nil {\n\t\t\t\tlogrus.Debugf(\"%#q does not exist, but sudo doesn't seem to require a password\", sudoersFile)\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\tlogrus.Debugf(\"%#q does not exist; passwordLessSudo error: %s\", sudoersFile, err)\n\t\t}\n\t\treturn fmt.Errorf(\"can't read %#q: %w: (Hint: %s)\", sudoersFile, err, hint)\n\t}\n\tsudoers, err := Sudoers()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif string(b) != sudoers {\n\t\t// Happens on upgrading socket_vmnet with Homebrew\n\t\treturn fmt.Errorf(\"sudoers file %#q is out of sync and must be regenerated (Hint: %s)\", sudoersFile, hint)\n\t}\n\treturn nil\n}\n","sourceCodeStart":100,"sourceCodeEnd":122,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/networks/sudoers.go#L100-L122","documentation":"The installed sudoers file exists but its contents no longer match what Lima would generate today, so Lima refuses to use it. This typically happens after upgrading socket_vmnet via Homebrew: the daemon path/version changes and the recorded start/stop commands in the sudoers file become stale.","triggerScenarios":"VerifySudoAccess reads sudoersFile successfully but string(b) != Sudoers() — the generated rules (group, daemon user/group, start/stop command lines) differ from the file on disk.","commonSituations":"Upgrading socket_vmnet with Homebrew (path changes from e.g. /opt/homebrew/Cellar/...), changing the networks.yaml group or daemon settings after installing the sudoers file, or hand-editing /etc/sudoers.d/lima.","solutions":["Run the Hint command to regenerate and reinstall: limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima","Re-run this after every socket_vmnet upgrade (e.g. brew upgrade socket_vmnet)","Avoid hand-editing /etc/sudoers.d/lima; always generate it with limactl sudoers","If networks.yaml changed (group/daemon paths), regenerate the sudoers file to match"],"exampleFix":"// before: stale sudoers after brew upgrade socket_vmnet\n// after\n$ limactl sudoers > etc_sudoers.d_lima && sudo install -o root etc_sudoers.d_lima /etc/sudoers.d/lima\n$ limactl start","handlingStrategy":"validation","validationCode":"want, err := limactlSudoersOutput() // `limactl sudoers`\nif err == nil {\n    got, err := os.ReadFile(\"/etc/sudoers.d/lima\")\n    if err == nil && string(got) != want {\n        // reinstall before starting any socket_vmnet network\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := verifySudoAccess(ctx, sudoersFile); err != nil {\n    if strings.Contains(err.Error(), \"out of sync\") {\n        // regenerate: limactl sudoers | sudo tee /etc/sudoers.d/lima\n    }\n}","preventionTips":["Regenerate the sudoers file after every `brew upgrade socket_vmnet`","Never hand-edit /etc/sudoers.d/lima; always generate with `limactl sudoers`","Regenerate after changing group or daemon paths in networks.yaml","Add the regen step to post-upgrade scripts/provisioning"],"tags":["network","sudo","sudoers-file","socket-vmnet","homebrew","version-drift"],"backgroundTag":"sudoers-file-out-of-sync","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}