Sudoers wildcards are only supported with globbing (man glob, man fnmatch). Yet, the start, stop, restart (, etc.) commands for systemctl cannot be globbed since they are not files.
The fact that you need to enumerate every command is a good thing from a security standpoint. If [email protected] is updated with a command, say shutdown-machine on a system update your sudo users will not be able to use it (thankfully).
There is a note about this in the sudoers manual:
Wildcards in command line arguments should be used with care.
Command line arguments are matched as a single, concatenated string. This mean a wildcard character such as ‘?’ or
‘*’ will match across word boundaries, which may be unexpected. For example, while a sudoers entry like:
%operator ALL = /bin/cat /var/log/messages*
will allow command like:
$ sudo cat /var/log/messages.1
It will also allow:
$ sudo cat /var/log/messages /etc/shadow
which is probably not what was intended. In most cases it is better to do command line processing outside of the
sudoers file in a scripting language.
On the other hand, if you want to save on typing you can do exactly what the manual suggests: use a scripting language. For example you could wirte something like this in, say, /usr/local/sbin/sudoers-dhcpd.sh:
#!/bin/sh
case "$1" in
start)
systemctl start [email protected]
;;
stop)
systemctl stop [email protected]
;;
restart)
systemctl restart [email protected]
;;
*)
echo You are not allowed to do that!
;;
esac
And add a sudoers line as follows:
%mygroup ALL=NOPASSWD: /usr/local/sbin/sudoers-dhcpd.sh
