better su entry

diff --git a/sample.sudoers b/sample.sudoers
index 7089c95c71e8deb52195d7617dd224cb7f748145..89661ab7fde14ac4c94d0f515ffcff7b741a02ba 100644 (file)
--- a/sample.sudoers
+++ b/sample.sudoers
@@ -87,5 +87,5 @@ jim           +biglab=ALL
 # he can also run /bin/date as uid -2 without entering a password
 fred           ALL=(oracle) /bin/ls,(#-2) NOPASSWD:/bin/date
 
-# somedude may su to anyone but root and must give su an argument
-somedude       ALL=/usr/bin/su ?*, !/usr/bin/su *root*
+# somedude may su to anyone but root and flags are not allowed
+somedude       ALL=/usr/bin/su [^-]*, !/usr/bin/su *root*