How to Use macOS sudoers File to Grant Specific Administrative Privileges

In macOS, if a user needs to install a printer, change network settings, or run advanced Terminal commands, the standard IT response is to make their account an “Administrator.” This is incredibly dangerous. An Administrator on macOS has the power to delete system files, bypass security controls, and install kernel-level malware. The principle of least privilege dictates that users should be Standard users. If a Standard user absolutely must run a specific administrative command, you should not make them an Admin; you should edit the sudoers file to grant them permission to run that one specific command.

What is the sudoers File?

The sudo command allows a permitted user to execute a command as the superuser (root). The /etc/sudoers file is the master configuration document that defines exactly who is allowed to use sudo and what commands they are allowed to run.

Step 1: Never Edit the File Directly (visudo)

The /etc/sudoers file is critical to system operation. If you make a typo in this file (like forgetting a comma) and save it, the sudo command will instantly break for everyone on the Mac. If sudo breaks, you cannot fix the file because you need sudo to edit it, trapping you in a Catch-22.

To prevent this, you must always use the visudo command. visudo opens the file in a temporary buffer, and when you try to save it, it aggressively checks for syntax errors. If it finds an error, it refuses to save, saving your system from destruction.

sudo visudo

This will open the file in the vi (or nano) text editor inside your Terminal.

Step 2: Understand the Syntax

Scroll down past the default configurations. You will see a line that looks like this:

%admin  ALL=(ALL) ALL

This is the rule that gives the standard macOS Administrator group its power. Let’s break down the syntax:

1. Who: %admin (The % symbol means it applies to a group, not a single user).
2. Where: ALL= (This rule applies on all network hosts).
3. As Whom: (ALL) (They can run commands as any user).
4. What: ALL (They can run absolutely any command).

Step 3: Grant a Specific Command to a Standard User

Suppose you have a Standard user named jdoe. They are a developer who needs to restart the Apache web server (apachectl restart) frequently. Instead of making them an Admin, add this line to the bottom of the sudoers file:

jdoe ALL=(root) /usr/sbin/apachectl restart

Now, when jdoe opens the Terminal and types sudo apachectl restart, it will work. However, if they try to type sudo rm -rf / or sudo softwareupdate -i -a, the system will reject it and log a security violation.

Step 4: The NOPASSWD Tag

By default, when jdoe runs their permitted command, sudo will ask them to enter their own password to verify they are actually sitting at the keyboard. If jdoe is using a script that needs to run in the background without human interaction, the password prompt will break the script.

You can bypass the password requirement for that specific command using the NOPASSWD: tag.

jdoe ALL=(root) NOPASSWD: /usr/sbin/apachectl restart

Step 5: Using Drop-in Files (The Best Practice)

While editing the main /etc/sudoers file works, it can get messy. macOS supports a drop-in directory at /etc/sudoers.d/. Instead of touching the main file, you can create a dedicated file just for your custom rules.

sudo visudo -f /etc/sudoers.d/jdoe_rules

You add the same syntax inside this new file. The main sudoers file will automatically read it. If you ever need to revoke jdoe‘s access, you simply delete the jdoe_rules file, keeping your core system configuration clean and untouched.