I try to restrict a backup daemon's user (that needs root access to client machines) so that it can only use the one command it needs. Thus, in /etc/sudoers, I use
daemonuser ALL=NOPASSWD: /backup/command --with --args *
I heard from a colleague that that method is no longer considered secure, but I could not find any details. Are there any security issues I need to be aware of?