Are the files in /etc/sudoers.d read in a particular order?

From man sudoers, the exact position found with this command:

$ LESS='+/sudo will suspend processing' man sudoers

Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. A consistent number of leading zeroes in the file names can avoid such problems.

That's under the title: Including other files from within sudoers

$ LESS='+/Including other files from within sudoers' man sudoers

Lexical order is also called "dictionary order" as given by the values defined by the environment variable LC_COLLATE when the locale is C (numbers then Uppercae then lowercase letters). That's the same order as given by LC_COLLATE=C ls /etc/sudoers.d/.

The list of files included and the specific order in which they are loaded could be exposed with:

$ visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/README: parsed OK
/etc/sudoers.d/me: parsed OK
/etc/dirtest/10-defaults: parsed OK
/etc/dirtest/1one: parsed OK
/etc/dirtest/2one: parsed OK
/etc/dirtest/30-alias: parsed OK
/etc/dirtest/50-users: parsed OK
/etc/dirtest/Aone: parsed OK
/etc/dirtest/Bone: parsed OK
/etc/dirtest/aone: parsed OK
/etc/dirtest/bone: parsed OK
/etc/dirtest/zone: parsed OK
/etc/dirtest/~one: parsed OK
/etc/dirtest/éone: parsed OK
/etc/dirtest/ÿone: parsed OK

Note that the order is not UNICODE but C.


From the sudoers manual (regarding the #includedir directive):

#includedir /etc/sudoers.d

sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files. Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. Using a consistent number of leading zeroes in the file names can be used to avoid such problems.

See man 5 sudoers.

The lexical ordering mentioned above is the same ordering that you get from ls (or echo *) in the C or POSIX locale.