Disallow User switching in Group

Greetings all

We would like to enable sudo I/O logging for specific users spread over 
multiple hosts.

For this to work, a users (member of group `sudo-iolog`) login shell is 
set to a wrapper, which executes e.g. /bin/bash via `sudo -E -u 
{{login_user}} /bin/bash -l`.
This way, a users entire session is neatly recorded.

To keep the sudoers config as generic as possible, the following config 
was created:

%sudo-iolog         ALL=(%sudo-iolog) SETENV: NOPASSWD: LOG_INPUT: LOG_OUTPUT: /bin/bash, /usr/bin/bash, /usr/local/bin/bash
...

This way, to enable I/O logging for a user, he just needs to be in the 
`sudo-iolog` group and have the correct login-shell.
As you might have guessed, this config allows `user1` in the 
`sudo-iolog` group to switch to `user2` in the same group with `sudo -u 
sudotest2 /bin/bash`.

Is there any way to match all users in group `%sudo-iolog` but restrict 
the `-u` option to the user calling `sudo` without explicitly writing 
the username in the config?


Regards
Patrik

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users