I'm trying to allow a group of users to gain some control over an instance of a dhcpcd service. In other words I would like to have them be able to run:systemctl (start,stop,...) dhcpcd@eth0.servicewithout being prompted for a password but only on dhcpcd@eth0.service. I have already come across ways of doing that, however they require enumeration of every subcommand in its own line.%mygroup ALL=NOPASSWD: /usr/bin/systemctl start dhcpcd@eth0.service, /usr/bin/systemctl stop dhcpcd@eth0.service, ...Is there a more elegant method of doing this?
Sudoers: Allow any subcommand for certain argument
sudo;administration
Sudoers wildcards are only supported with globbing (man glob, man fnmatch).  Yet, the start, stop, restart (, etc.) commands for systemctl cannot be globbed since they are not files.The fact that you need to enumerate every command is a good thing from a security standpoint.  If dhcpcd@eth0.service is updated with a command, say shutdown-machine on a system update your sudo users will not be able to use it (thankfully).There is a note about this in the sudoers manual: Wildcards in command line arguments should be used with care. Command line arguments are matched as a single, concatenated string.  This mean a wildcard character such as ? or * will match across word boundaries, which may be unexpected.  For example, while a sudoers entry like:     %operator ALL = /bin/cat /var/log/messages* will allow command like:     $ sudo cat /var/log/messages.1 It will also allow:     $ sudo cat /var/log/messages /etc/shadow which is probably not what was intended.  In most cases it is better to do command line processing outside of the sudoers file in a scripting language.On the other hand, if you want to save on typing you can do exactly what the manual suggests: use a scripting language.  For example you could wirte something like this in, say, /usr/local/sbin/sudoers-dhcpd.sh:#!/bin/shcase $1 in  start)    systemctl start dhcpcd@eth0.service    ;;  stop)    systemctl stop dhcpcd@eth0.service    ;;  restart)    systemctl restart dhcpcd@eth0.service    ;;  *)    echo You are not allowed to do that!    ;;esacAnd add a sudoers line as follows:%mygroup ALL=NOPASSWD: /usr/local/sbin/sudoers-dhcpd.sh