Your command allows wheel group users to run
rm /CT/. Nothing more. Nothing less.
You could try this, which will allow users to remove
/CT/ and anything inside it provided they use the exact same flags as specified here:
%wheel ALL=(ALL) /bin/rm -rf /CT/*
My general preference for
sudo control is to write a script that validates the arguments, and have that script permitted through
sudo. Perhaps something like this might suffice, which checks that the target is a file inside the folder
for item in "$@"
if [[ "$real" =~ ^/CT/. ]] && [[ -f "$real" ]]
rm -f -- "$item"
[[ -t 2 ]] && echo "Refusing to remove '$item'" >&2
You can add other conditions to require the target to be a directory, to have particular ownership, etc.