How to Fix ‘sudo: /etc/sudoers is world writable’ and Syntax Errors in Ubuntu

Attempting to execute administrative commands in Ubuntu using sudo can sometimes result in an immediate refusal: “sudo: /etc/sudoers is world writable. sudo: no valid sudoers sources found, quitting. sudo: unable to initialize policy plugin” or “sudo: parse error in /etc/sudoers near line X”. Because sudo itself is broken, you cannot use sudo to fix the file, leaving you locked out of administrative access.

This security lockout occurs because the sudo binary enforces strict security boundaries on its configuration file. If permissions on /etc/sudoers are accidentally broadened (e.g. using chmod 777) or if a syntax error was introduced using a standard text editor rather than visudo, sudo refuses to run to protect system integrity. This guide details how to regain root access using pkexec or GRUB recovery mode and restore correct permissions.

Method 1: Restore Permissions Using pkexec (Graphical / Polkit Shell)

Ubuntu includes PolicyKit (pkexec), an alternate privilege elevation mechanism that operates independently of sudo. If PolicyKit permissions are intact, you can restore sudoers permissions directly from your active session.

1. Open your terminal window (Ctrl + Alt + T).
2. Execute the chmod command using pkexec to set the required read-only permission mode 0440:

   pkexec chmod 0440 /etc/sudoers

3. A graphical or text password dialogue will prompt you to enter your user password.
4. Type your password and press Enter.
5. Also verify that the directory permissions on /etc/sudoers.d are correct:

   pkexec chmod 0755 /etc/sudoers.d
   pkexec chmod 0440 /etc/sudoers.d/*

6. Test your administrative access by running sudo -v. Sudo will now function normally.

Method 2: Fix Sudoers Syntax Errors Using pkexec visudo

If the error reports a “parse error in /etc/sudoers” rather than a permissions issue, use PolicyKit to launch the safe visudo editor.

1. In the terminal, run:

   pkexec visudo

2. Authenticate with your user password.
3. The visudo editor will open and automatically jump to the line containing the syntax error.
4. Correct the broken line (or delete the invalid entry).
5. Press Ctrl + O and Enter to save, followed by Ctrl + X to exit. visudo validates syntax before writing to disk, ensuring no further syntax errors occur.

Method 3: Recover via Ubuntu GRUB Root Recovery Mode

If pkexec fails with an error (e.g. “pkexec must be setuid root”), you can boot into Ubuntu’s single-user root shell without needing a password.

1. Reboot your computer.
2. Hold down the Shift key (or press Esc repeatedly on UEFI systems) during boot to display the GRUB menu.
3. Select Advanced options for Ubuntu.
4. Highlight the entry ending in (recovery mode) and press Enter.
5. In the Recovery Menu, use the arrow keys to select root – Drop to root shell prompt, and press Enter.
6. Because recovery mode mounts the filesystem as read-only by default, remount it with write access:

   mount -o remount,rw /

7. Restore the correct ownership and permissions:

   chown root:root /etc/sudoers
   chmod 0440 /etc/sudoers

8. If you need to fix syntax errors, run:

   visudo

9. Reboot into normal Ubuntu:

   reboot

Sudoers Permissions and Ownership Reference Table

The table below provides a quick reference for standard security permissions across Ubuntu sudo configuration paths:

File / Directory	Correct Ownership	Correct Numeric Mode	Permissions String
/etc/sudoers	root:root	0440	-r--r-----
/etc/sudoers.d/	root:root	0755	drwxr-xr-x
/etc/sudoers.d/*	root:root	0440	-r--r-----
/usr/bin/sudo	root:root	4755 (SUID)	-rwsr-xr-x

Best Practices When Editing Sudo Configurations

Never edit /etc/sudoers directly using standard text editors like nano or gedit. Always use the official command sudo visudo, which locks the file against concurrent edits and performs rigorous syntax checking before committing changes to disk. Alternatively, place modular configuration snippets inside /etc/sudoers.d/ using sudo visudo -f /etc/sudoers.d/custom-rule.