{"record":{"id":"b78c25d319b2c561","repo":"lima-vm/lima","slug":"failed-to-write-to-sudoers-file-q-for-user-q","errorCode":null,"errorMessage":"failed to write to sudoers file %#q for user %#q: %w","messagePattern":"failed to write to sudoers file %#q for user %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go","lineNumber":334,"sourceCode":"}\n\n// writeSudoers appends a sudoers entry for the given user.\n// writeSudoers is expected be called only once on creating the user account.\nfunc writeSudoers(userName, sudo string) error {\n\tif strings.Contains(sudo, \"\\n\") {\n\t\treturn errors.New(\"sudo field must not contain newline characters\")\n\t}\n\tif err := os.MkdirAll(\"/etc/sudoers.d\", 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create /etc/sudoers.d directory: %w\", err)\n\t}\n\tsudoersPath := \"/etc/sudoers.d/90-cloud-init-users\"\n\tf, err := os.OpenFile(sudoersPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o400)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open sudoers file %#q: %w\", sudoersPath, err)\n\t}\n\tif _, err = fmt.Fprintf(f, \"%s %s\\n\", userName, sudo); err != nil {\n\t\t_ = f.Close()\n\t\treturn fmt.Errorf(\"failed to write to sudoers file %#q for user %#q: %w\", sudoersPath, userName, err)\n\t}\n\treturn f.Close()\n}\n\nfunc writeFiles(ctx context.Context, entry cloudinittypes.WriteFile) error {\n\tif entry.Path == \"\" {\n\t\treturn errors.New(\"path is required for write_files entry\")\n\t}\n\tperm := os.FileMode(0o644)\n\tif entry.Permissions != \"\" {\n\t\tp, err := strconv.ParseUint(entry.Permissions, 8, 32)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions %#q for path %#q: %w\", entry.Permissions, entry.Path, err)\n\t\t}\n\t\tperm = os.FileMode(p)\n\t}\n\tif err := os.MkdirAll(filepath.Dir(entry.Path), 0o755); err != nil {\n\t\treturn fmt.Errorf(\"failed to create parent directory for path %#q: %w\", entry.Path, err)","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go#L316-L352","documentation":"The fmt.Fprintf write of the `<userName> <sudo>` line to /etc/sudoers.d/90-cloud-init-users failed after the file was opened successfully. The file handle is closed before returning, and provisioning of this user's sudo access aborts.","triggerScenarios":"The write syscall behind fmt.Fprintf errors: ENOSPC (disk full), EBADF/EIO (I/O error on the file handle or underlying volume), or the file was concurrently removed/locked by another process between open and write.","commonSituations":"Disk-full VM during provisioning; concurrent provisioning processes appending to the same sudoers file; underlying APFS volume I/O errors.","solutions":["Free disk space in the guest if the wrapped error is ENOSPC","Ensure only one provisioning pass runs at a time (avoid concurrent processUserData)","Check volume health / I/O errors in the wrapped cause","Reprovision the user after fixing; the file is opened with O_APPEND so retries are safe"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if fi, err := os.Stat(\"/etc/sudoers.d/90-cloud-init-users\"); err == nil && fi.Size() > 1<<20 {\n    return errors.New(\"sudoers drop-in suspiciously large; inspect before appending\")\n}\n// also ensure free space: syscall.Statfs(\"/etc\", &st); st.Bavail*uint64(st.Bsize) > 1MB","typeGuard":null,"tryCatchPattern":"if err := processUserData(ctx, data); err != nil {\n    if strings.Contains(err.Error(), \"write to sudoers file\") {\n        log.Printf(\"sudoers write failed: %v\", err)\n        // O_APPEND makes a retry after freeing space safe\n        if retryErr := processUserData(ctx, data); retryErr != nil {\n            log.Printf(\"retry failed: %v\", retryErr)\n        }\n    }\n}","preventionTips":["Keep guest disks sized with headroom","Serialize provisioning runs (no concurrent processUserData)","Monitor ENOSPC/EIO in guestagent logs and alert early"],"tags":["sudoers","filesystem","macos","guestagent"],"backgroundTag":"file-write-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}