{"record":{"id":"40c62c8edc420760","repo":"lima-vm/lima","slug":"failed-to-open-sudoers-file-q-w","errorCode":null,"errorMessage":"failed to open sudoers file %#q: %w","messagePattern":"failed to open sudoers file %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go","lineNumber":330,"sourceCode":"\t\t\treturn fmt.Errorf(\"failed to write sudoers file for user %#q: %w\", u.Name, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// writeSudoers appends a sudoers entry for the given user.\n// writeSudoers is expected be called only once on creating the user account.\nfunc writeSudoers(userName, sudo string) error {\n\tif strings.Contains(sudo, \"\\n\") {\n\t\treturn errors.New(\"sudo field must not contain newline characters\")\n\t}\n\tif err := os.MkdirAll(\"/etc/sudoers.d\", 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create /etc/sudoers.d directory: %w\", err)\n\t}\n\tsudoersPath := \"/etc/sudoers.d/90-cloud-init-users\"\n\tf, err := os.OpenFile(sudoersPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o400)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open sudoers file %#q: %w\", sudoersPath, err)\n\t}\n\tif _, err = fmt.Fprintf(f, \"%s %s\\n\", userName, sudo); err != nil {\n\t\t_ = f.Close()\n\t\treturn fmt.Errorf(\"failed to write to sudoers file %#q for user %#q: %w\", sudoersPath, userName, err)\n\t}\n\treturn f.Close()\n}\n\nfunc writeFiles(ctx context.Context, entry cloudinittypes.WriteFile) error {\n\tif entry.Path == \"\" {\n\t\treturn errors.New(\"path is required for write_files entry\")\n\t}\n\tperm := os.FileMode(0o644)\n\tif entry.Permissions != \"\" {\n\t\tp, err := strconv.ParseUint(entry.Permissions, 8, 32)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions %#q for path %#q: %w\", entry.Permissions, entry.Path, err)\n\t\t}","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go#L312-L348","documentation":"Opening /etc/sudoers.d/90-cloud-init-users with O_CREATE|O_WRONLY|O_APPEND and mode 0400 failed. The agent appends each cloud-init user's sudo rule to this shared drop-in file; failure means sudo grants cannot be installed for this user.","triggerScenarios":"writeSudoers gets an error from os.OpenFile on the sudoers drop-in: the parent directory is unwritable or missing, the existing file is owned by another user with restrictive bits and the agent is not root, or an immutable/flags restriction applies.","commonSituations":"A previous run left 90-cloud-init-users owned by root with mode 0400 and the current process is not root; MDM/security tooling protecting /etc/sudoers.d; ENOSPC or EROFS on /etc.","solutions":["Run the guestagent as root (opening/creating under /etc requires it)","Check ownership/permissions of /etc/sudoers.d/90-cloud-init-users and correct them","Verify the volume containing /etc is writable and has free space","As a last resort, delete the instance and reprovision cleanly"],"exampleFix":"// inside the VM (recovery)\nsudo chown root:wheel /etc/sudoers.d/90-cloud-init-users\nsudo chmod 400 /etc/sudoers.d/90-cloud-init-users","handlingStrategy":"try-catch","validationCode":"if os.Geteuid() != 0 {\n    return errors.New(\"opening /etc/sudoers.d/90-cloud-init-users requires root\")\n}\nif _, err := os.OpenFile(\"/etc/sudoers.d/90-cloud-init-users\", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o400); err != nil {\n    return fmt.Errorf(\"sudoers drop-in not writable: %w\", err)\n} else { /* close handle in real code */ }","typeGuard":null,"tryCatchPattern":"var pe *os.PathError\nif errors.As(err, &pe) && strings.Contains(err.Error(), \"open sudoers file\") {\n    log.Printf(\"sudoers open failed at %s: %v (perm=%d)\", pe.Path, pe.Err, pe.Perm)\n    // remediate: fix ownership/perms or rerun as root\n}","preventionTips":["Run provisioning as root","Check ownership of /etc/sudoers.d/90-cloud-init-users after previous runs","Avoid security tools that lock /etc/sudoers.d during guest boot"],"tags":["sudoers","filesystem","permissions","macos"],"backgroundTag":"file-open-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}