add more restrictive sudo access to non-roots