move sudoers rule to sudoers.d