Couple of things:
sudo is for elevating yourself to a higher level of credentials for either a command or set of commands, not for gaining access to a directory with which you (1) aren't either the owner, (2) in a group that has read permissions to said directory, or (3) the directory doesn't have the other permissions opened to the world.
/etc/sudoers is the file that contains all the rules for a given system and stipulates which users, groups of users, can run which commands in an elevated way as
root, typically, or some other user account. You typically do NOT want to edit this file directly, though you can, it's best not to do so.
visudo is the prescribed way for editing the
If you want to see what sudo credentials a user has access to, the simplest way is to become that user and run the command,
$ sudo -l
Matching Defaults entries for saml on this host:
env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User saml may run the following commands on this host:
(root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root) /usr/lib/jupiter/scripts/resolutions, (root)
/usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root) /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi
I believe you're referring to the users' group
wheel, which is an old way (to my knowledge) way of granting users permissions to become root via
su -. This article does a good job of discussing the use of this group, titled: Administering your Linux system.
Granting access to
To my knowledge there is no systematic way to do this without giving this user elevated privileges in other ways that you're trying to limit. I would say that if you do not trust this particular user the responsibility of having access in this fashion then they are probably not the right person to be doing this work!
For example. Say I have 2 students and 1 TA. Students (user1 & user2) TA (user3).
So the groups would be as follows:
So when I logged into the system as any of the above users (1-3), my groups would be as follows:
users vboxusers class1
This groups would also need to be set on the student's home dirctories:
$ ls -l /home/user1 | head -3
drwxrwxr-x 2 saml class1 4096 May 16 22:02 alsa
drwxrwxr-x 31 saml class1 4096 Mar 26 12:09 apps
This is just one idea, it has issues with this approach, but given the information you've provided is "one way to do it"!