Consider the following line in a
username ALL=(ALL) ALL, !/usr/bin/passwd
as far as I know, this allows user
username to use sudo, unless he not uses
/usr/bin/passwd. But apparantly the user is still able to get a root shell using
sudo -i and do whatever he likes. Have I understood this correctly? What would be a better configuration if I indeed want to disallow the user to change any password as root.