Sudoers wildcards are only supported with globbing (
man fnmatch). Yet, the
restart (, etc.) commands for
systemctl cannot be globbed since they are not files.
The fact that you need to enumerate every command is a good thing from a security standpoint. If
firstname.lastname@example.org is updated with a command, say
shutdown-machine on a system update your sudo users will not be able to use it (thankfully).
There is a note about this in the sudoers manual:
Wildcards in command line arguments should be used with care.
Command line arguments are matched as a single, concatenated string. This mean a wildcard character such as ‘?’ or
‘*’ will match across word boundaries, which may be unexpected. For example, while a sudoers entry like:
%operator ALL = /bin/cat /var/log/messages*
will allow command like:
$ sudo cat /var/log/messages.1
It will also allow:
$ sudo cat /var/log/messages /etc/shadow
which is probably not what was intended. In most cases it is better to do command line processing outside of the
sudoers file in a scripting language.
On the other hand, if you want to save on typing you can do exactly what the manual suggests: use a scripting language. For example you could wirte something like this in, say,
case "$1" in
systemctl start email@example.com
systemctl stop firstname.lastname@example.org
systemctl restart email@example.com
echo You are not allowed to do that!
And add a sudoers line as follows:
%mygroup ALL=NOPASSWD: /usr/local/sbin/sudoers-dhcpd.sh