{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":32369,"path":"it-service-management/digital-end-user-experience-dex/config-sudoers-file.md","title":"Configure ServiceNow sudoers file","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure ServiceNow sudoers file\n\nConfigure the ServiceNow sudoers file to grant the servicenow user the necessary permissions to run specific commands with elevated privileges. This configuration uses a drop-in file in /etc/sudoers.d/ to maintain secure, isolated sudo rules for ServiceNow operations.\n\n## Before you begin\n\nRole required: admin\n\n## Procedure\n\n1.  Open Terminal with Root Access by running `sudo -i`.\n\n2.  Create and edit the drop-in sudoers file by running `visudo -f /etc/sudoers.d/_servicenow`.\n\n3.  Paste the following content into the editor:\n\n    ```\n    # ServiceNow Agent Collector - Sudoers Configuration for macOS\n    \n    # Command alias for ServiceNow allowed commands\n    # These commands can be executed by the _servicenow user with sudo privileges\n    Cmnd_Alias SN_ALLOWED = /usr/bin/powermetrics, \\\n                            /usr/bin/mdls, \\\n                            /usr/bin/log, \\\n                            /usr/bin/log show *, \\\n                            /bin/kill, \\\n                            /usr/bin/defaults, \\\n                            /usr/local/bin/jamf, \\\n                            /bin/rm, \\\n                            /bin/ls, \\\n                            /usr/bin/pgrep, \\\n                            /usr/bin/find, \\\n                            /usr/bin/pmset, \\\n                            /usr/bin/open, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/app_freeze.sh, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/zscaler_zpa_reconnect.sh, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/clear_google_chrome_browsing_data.sh, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/services.sh, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/restart_service.sh *, \\\n                            /Applications/Zscaler/Zscaler.app/Contents/PlugIns/zscli, \\\n                            /Library/Application\\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/elevate_temporary_admin.sh\n    \n    # ServiceNow user permissions\n    # _servicenow user can run osqueryi and all SN_ALLOWED commands without password\n    # SETENV allows environment variables to be preserved\n    _servicenow ALL=NOPASSWD: SETENV: /Library/Application\\ Support/servicenow/agent-client-collector/cache/osquery/bin/osqueryi *, SN_ALLOWED\n    \n    # Defaults for _servicenow user\n    # !requiretty: Allow sudo without a TTY (required for automated scripts)\n    Defaults:_servicenow !requiretty\n    ```\n\n4.  Save and exit.\n\n5.  Validate the file syntax by running `visudo -c -f /etc/sudoers.d/_servicenow`.\n\n    Expected output: `/etc/sudoers.d/_servicenow: parsed OK`.\n\n6.  Set the file permissions:\n\n    -   chown root:wheel /etc/sudoers.d/\\_servicenow\n    -   chmod 440 /etc/sudoers.d/\\_servicenow\n7.  Confirm the drop-in directory is included in the sudoers file by running `grep -i includedir /etc/sudoers`.\n\n    Expected output: `#includedir /etc/sudoers.d`.\n\n8.  Test permissions for the servicenow user by running `sudo -u _servicenow sudo -l`.\n\n    List all allowed commands confirming the rules are active.\n\n\n**Parent Topic:**[Installing DEX on your local machine](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-service-management/digital-end-user-experience-dex/installing-dex-local.md)\n\n"}}