Fix 'Permission denied' when running sudo on Linux

You type sudo apt update or sudo systemctl restart nginx, and instead of running the command, you get a plain Permission denied. It's infuriating, especially when you're already using sudo. This usually happens when your user account isn't in the sudo group, or the /etc/sudoers file has a syntax error or is missing your user's entry. I've seen this trip up new Ubuntu, Debian, and CentOS users for years.

Root cause

The kernel checks two things when you run sudo: first, whether your user is allowed to use sudo at all (via /etc/sudoers or a file in /etc/sudoers.d/), and second, whether the command itself is executable. A plain Permission denied without any password prompt almost always means your user isn't in the sudoers system. The most common cause? You installed the OS and created a user but forgot to add them to the sudo group during setup.

Fix: Add your user to the sudo group

You need root access to fix this. If you have the root password, great. If you don't, you'll need to boot into recovery mode or use a live USB. Let's assume you have the root password or you've booted into single-user mode.

1. Open a terminal and switch to root:

su -

Enter the root password when prompted.

2. Add your user to the sudo group (replace yourusername with your actual username):

usermod -aG sudo yourusername

On CentOS/RHEL 7 and older, the group is often wheel instead of sudo:

usermod -aG wheel yourusername

3. Verify the change:

groups yourusername

You should see sudo or wheel in the output.

4. Log out and log back in. A simple exit from root and then exit from your user session works. Then open a new terminal and test:

sudo whoami

Expected output: root.

Fix: Check the sudoers file syntax

If you're already in the sudo group but still getting Permission denied, the sudoers file might have a typo. Never edit /etc/sudoers directly with a regular text editor — use visudo which checks syntax before saving.

1. As root, run:

visudo

Look for a line that includes your username or group. It should look like one of these:

yourusername ALL=(ALL) ALL

Or for the group:

%sudo ALL=(ALL) ALL

If the line has a typo (e.g., %sduo instead of %sudo), fix it and save.

2. Also check for any NOPASSWD entries that might be misconfigured. A full line example:

yourusername ALL=(ALL) NOPASSWD: ALL

Fix: Check file permissions on /etc/sudoers

Another sneaky cause: /etc/sudoers has wrong permissions. It should be owned by root and have permissions 0440. If someone changed them, sudo might refuse to read it.

1. As root, check:

ls -l /etc/sudoers

Expected output: -r--r----- 1 root root. If not, fix it:

chmod 440 /etc/sudoers
chown root:root /etc/sudoers

Still broken?

Three things to check if you've done all the above:

• Are you in a container? Some Docker containers don't have sudo installed at all. Run apt update && apt install sudo (as root) to add it.
• Did you mistype your username? Check with id and whoami. If your username has a typo, correct it with usermod -l newname oldname.
• Is sudo installed? Run which sudo. If nothing comes back, install it: apt install sudo or yum install sudo.

Once you fix the group membership or the sudoers file, the Permission denied error should vanish. It's almost always something simple — but when it's not, check those last three gotchas.