lima-vm/lima · error

can check only a single sudoers file

Error message

can check only a single sudoers file

What it means

Error returned by the `limactl sudoers --check`/verify path (verifySudoAccess in cmd/limactl/sudoers_darwin.go:64) when more than one sudoers file path is passed on the command line. The check accepts at most one explicit sudoers file argument: with zero arguments it falls back to the sudoers path configured in networks.yaml, and with exactly one it verifies that file. Passing two or more paths (e.g. `limactl sudoers --check a b`) triggers this error. Fix by supplying only a single sudoers file path, or no argument to use the configured default.

Source

Thrown at cmd/limactl/sudoers_darwin.go:64

		return err
	}
	fmt.Fprint(cmd.OutOrStdout(), sudoers)
	return nil
}

func verifySudoAccess(ctx context.Context, nwCfg networks.Config, args []string, stdout io.Writer) error {
	var file string
	switch len(args) {
	case 0:
		file = nwCfg.Paths.Sudoers
		if file == "" {
			cfgFile, _ := networks.ConfigFile()
			return fmt.Errorf("no sudoers file defined in %#q", cfgFile)
		}
	case 1:
		file = args[0]
	default:
		return errors.New("can check only a single sudoers file")
	}
	if err := nwCfg.VerifySudoAccess(ctx, file); err != nil {
		return err
	}
	fmt.Fprintf(stdout, "%#q is up-to-date (or sudo doesn't require a password)\n", file)
	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Pass only a single file path per invocation
2. Quote globs or loop over files, calling the command once per file
3. Omit the argument to check the configured path instead

Example fix

// before
limactl sudoers --check /etc/sudoers.d/lima /etc/sudoers.d/other
// after
for f in /etc/sudoers.d/lima /etc/sudoers.d/other; do limactl sudoers --check "$f"; done

files=(/etc/sudoers.d/lima); [[ ${#files[@]} -eq 1 ]] || { echo 'pass exactly one file'; exit 2; }

for f in /etc/sudoers.d/*; do limactl sudoers --check "$f" || echo "check failed: $f"; done

When it happens

Trigger: `limactl sudoers --check fileA fileB` (2+ args).

Common situations: Trying to validate several sudoers fragments at once; shell glob expanding to multiple files, e.g. `limactl sudoers --check /etc/sudoers.d/*`.

Understand the failure class

Background: "Unknown argument", "Invalid value", and "must be one of": invalid CLI argument errors explained — this error's family across 35 libraries.

Related errors

• the file argument can be specified only for --check mode
• unexpected arguments %v
• no sudoers file defined in %#q
• sudoers command is only supported on macOS right now
• limactl is running under rosetta, please reinstall lima with

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/11779a89691795aa. Report an issue: GitHub.