At my site the typical sudoers setup has
Defaults mail_always globally set so we can keep track of what the users are generally using sudo for (which should be very infrequent) and sort out fixing the permissions for common actions. This is disabled per role account that needs to execute things as root.
We've shifted to a policy of discourage direct logins as role accounts for the purposes of auditing and preventing the role users from becoming "party accounts". Thus, we have a lot of logins as a regular user than then immediately invoke
sudo -u <role account> -i. I would really like to set
!mail_always just for the
-i action (which AFAIK, there is no way to specific set rules for -i in sudo) or user X running a command as just user foo. Is this possible? I feel the syntax should be something like this:
Defaults[:!>]realuser ALL = (roleuser) NOPASSWD: ALL !mail_always
I've found a livable, if not ideal solution:
Defaults>ROLE_ACCOUNTS !mail_always %wheel ALL = (ROLE_ACCOUNTS) NOPASSWD: ALL
This isn't ideal as any user, not just the members of the wheel group, will not generate email notifications when running commands or invoking login shells as one of the role accounts.