Assume I have a collection of unprivileged users (user01, user02, user03, ...) who are members of a Linux security group called 'x_users':
$ groups user01
user01 : user01 x_users
Further, assume I have a collection of admin users (admin01, admin02, admin03, ...) who are all members of a Linux security group called 'x_admins':
$ groups admin01
admin01 : admin01 x_admins
I want each member of the x_admin group to have the ability to use sudo(8) and su(1) to invoke an interactive login shell as any user who is a member of the x_users group, e.g.,
[admin01 ~]$ sudo su - user01
[user01 ~]$ # do stuff as user01
[user01 ~]$ exit
[admin01 ~]$
Members of the x_admins group may not use sudo(8) and su(1) to invoke an interactive logon shell for any user who is not a member of the x_users group:
[admin01 ~]$ sudo su - nonxuser
[sudo] password for admin01:
Sorry, user admin01 is not allowed to execute '/bin/su - nonxuser' as root on localhost
[admin01 ~]$
One way to accomplish this is to create a config file '/etc/sudoers.d/x_admins' as follows:
# /etc/sudoers.d/x_admins
User_Alias ADMINS = %x_admins, %wheel
ADMINS ALL = (root) /bin/su - user01
ADMINS ALL = (root) /bin/su - user02
ADMINS ALL = (root) /bin/su - user03
# ...
Of course, manually listing the individual members of the x_users group in a sudoers config file is tedious and error prone. Is there a more concise way of accomplishing this in the sudoers config file?