Why the last matching command matters
Sudoers is not a “most specific rule wins” policy. When multiple user specifications match, they are applied in order and the last matching command specification determines the permission and tags. A later broad allow can therefore undo an earlier denial; the trace keeps that order and exact file/line provenance visible.
Supported behavior
The bounded parser supports common User_Alias, Runas_Alias, Host_Alias, and Cmnd_Alias lists with negation and recursive expansion; global and user/host/run-as/command-scoped Defaults; inline include files and lexical include directories; user groups; host globs; run-as users and groups; absolute command paths, directory specifications, argument globs, ALL, inherited command tags, and repeated rules. Batch CSV results and optional Policy B differences can be exported as CSV or JSON.
Analysis boundary and authoritative verification
This is an analysis aid, not sudo, visudo, or an authorization decision. It never executes a command, reads local accounts or groups, resolves DNS, opens executable files, calculates digests, checks filesystem ownership, or loads the host’s real policy. Numeric IDs, netgroups, non-Unix groups, IP networks, command digests, command regular expressions, plugin-specific behavior, some escaping, and the complete sudoers grammar remain unsupported or unresolved.
Before deployment, validate the exact files with the target version’s visudo -c or visudo -cf /path/to/file. On the intended host and identity, use sudo -l or sudo -ll to inspect the effective privileges and source information. Test in a recoverable administrative session so a policy mistake cannot lock out access.
Risk warnings are prompts, not proofs
The tool highlights broad ALL, NOPASSWD: ALL, command negation, wildcards, SETENV, and commonly escape-capable programs. A warning does not prove exploitation, and the absence of a warning does not prove safety. Paths, writable scripts, interpreters, editors, pagers, environment variables, command arguments, symlinks, and version-specific behavior all require host-side review.
Reference behavior
The official sudoers manual documents aliases, Defaults scopes, ordered matching, command tags, include behavior, password tags, and the security limits of command negation. The sudo project’s sudo -ll source-information note explains the richer provenance available in newer sudo versions.
Frequently asked questions
Why did a less specific later rule win?
Sudoers applies matching entries in order; it does not calculate specificity. The last matching command specification supplies the effective allow/deny state and its inherited tags.
Why is a result unresolved?
A relevant later candidate uses a construct this browser tool cannot safely or faithfully evaluate, such as an executable digest, network-dependent host expression, numeric identity, or regex command. The tool refuses to guess whether that candidate overrides an earlier result.
Does NOPASSWD mean the command is unrestricted?
No. It describes authentication for the matching command specification. User, host, run-as, command, environment, and other policy restrictions still matter.
Can I paste secrets here?
The analysis is local, but avoid placing credentials or unrelated secrets in policy text. Analytics receives ordinary page-level traffic, not the textarea contents.
Browse system and forensic tools · Simulate SSH configuration precedence · Audit CODEOWNERS precedence