As noticed by Dmitry Nedospasov (Cf. [1]), sudoers file should not be copied by default. Move this hook to a role, and add a warning about this in role. [1] http://xen-tools.org/pipermail/xen-tools-dev/2010-July/000146.html