VPN Button Needs sudo: Scope the Rule, Validate the Policy

The VPN button works for the administrator and fails for everyone else, so someone adds a line to sudoers. That line usually outlives the problem it was meant to solve, and it often grants more than the button needs. Before you edit the policy, check whether the supported connection owner can already do the job. The three conditions below decide whether sudo is involved at all.

Condition 1: the supported owner can do it without sudo

On most Linux desktops the network manager already owns VPN connections, and its authorization goes through polkit rather than sudo. A user who is allowed to bring a connection up can do it from the command line without any root rule at all. Check what the manager permits before you assume the button needs privilege. If the answer is yes, the sudoers change is solving a problem that does not exist.

nmcli connection show
nmcli connection up "Work VPN"

If the manager refuses, read why: a missing polkit rule, a connection owned by another user or a profile stored where the user cannot read it. Each of those has a supported fix that is narrower than a sudo rule. A privilege escalation is the last resort, not the first.

Condition 2: the rule names one executable and its arguments

If sudo is genuinely required, the rule should name the exact command and, where possible, the arguments it may use. A rule that lets a user run a wrapper script is only as safe as that script's permissions, because the user can edit what root will execute. A rule with a wildcard after the command is the same problem in a shorter form.

sudo -l -U alice
ls -l /usr/local/sbin/vpn-up

Check every path in the command chain: the binary, the script it calls, the configuration file it reads and any directory in between. If any of them is writable by the user, the scoped rule is effectively unrestricted root. Arguments matter too, because a command that accepts a config path can be pointed at a file the user controls. Write the rule for the operation, not for the button.

Stop if the command needs a user-controlled file to work. Then the design is wrong, and no sudoers syntax will make it safe.

Condition 3: the whole policy parses, not just your line

Validate with the editor that locks the file and checks syntax, and validate the assembled policy rather than a fragment. A file that parses on its own can still break the include order or duplicate a rule in a way that changes behaviour. The visudo manual documents both the locking editor and the check-only mode used here.

sudo visudo -c
sudo visudo -cf /etc/sudoers.d/vpn-launcher

The check reports the file and the line when it fails, and that report is the useful part. Repair the intended change through the editor rather than force-saving a known error, because a broken policy can lock every administrator out at once. Files under the include directory also need the ownership and mode the manual requires, or they will be ignored or rejected. Syntax is only the first gate: after it passes, read the rule again and ask what it actually allows.

Stop if the only way to make the change work is to disable the syntax check. That is not a policy, it is an outage waiting for a reboot.

Recovery: keep a session that still works

Before you save, make sure an authorized administrative session is already open and that a second path into the machine exists. A sudoers mistake can remove your ability to fix it, and a desktop button is not worth that risk. If sudo is already broken, use the system's documented recovery path rather than improvising one.

sudo -n true
id

Alternatives such as pkexec depend on their own installation and policy, so they are not a guaranteed second root prompt. Keep local authorization separate from supplying the VPN secret as well: a sudo rule cannot unlock an absent secret agent, and it does not satisfy the gateway's MFA. After the correction, test the normal account performing only the intended operation, then use the manager's ordinary controls.

The decision ends when you can say which condition justified sudo, what the rule names, that the whole policy parses, and how you would recover if it did not. A privileged launcher that costs you administrative access is a bad trade, and it is usually an avoidable one.