Knowing that giving a user a sudo's grace period right from the point when he/she login might be a security issue, I still think it will be a beneficial trade-off between security and usability in my setup.
The question is: how to do that? As far as I know, the sudo doesn't provide CLI for it.
I might somehow divert the gdm's typed password to something like
sudo false, but again: how to get hold of the provided by the user password in the plain text? Should I write a custom
pam module for it?
Or maybe it is better to immerse into implementation details of the sudo and as a root directly manipulate the timestamp database?