Return to Revisions

By adjusting the sudoers file (/etc/sudoers) with sudo visudo it should be possible to accomplish this. It is a hell of a job and you need a profound knowledge of all commands to fine-tune this while avoiding errors and loopholes though.

You have to add the user to the User privilege specification section

...
# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL
...

Then use a whitelist (or a blacklist) of allowed (or disallowed) commands:

whitelist:

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL
user    ALL=/usr/bin/nano,/usr/bin/opensnoop

blacklist:

# User privilege specification
root    ALL=(ALL) ALL
%admin  ALL=(ALL) ALL
user    ALL=!/usr/libexec/PlistBuddy,!/usr/bin/passwd,!/usr/sbin/*

You may mix whitelist and blacklist.

Please check man sudoers how to simplify things or narrow things down by configuring User, Runas, Host and Cmnd alias specifications.