more restrictive sudoers settings