Limiting a user's commands causes a validation error about sudo HOT 5 CLOSED

Before you go too much further, try specifying:

       commands ["/usr/bin/rsync"]

from sudo.

I can confirm that systemctl blah didn't work in my case, whereas /bin/systemctl blah did.

from sudo.

I can also confirm this issue, for me testing with pacman doesn't work, but /usr/bin/pacman does:

  sudo 'makepkg-pacman' do
    user 'makepkg'
    nopasswd true
    commands ['/usr/bin/pacman'] # Working!
    notifies :reload, 'ohai[reload]', :immediately
  end

from sudo.

I think we could inspect each element of commands and bail with a more useful error when a command does not start with / or ..

from sudo.

So I believe the reasoning is that sudoers is a very low level system which can only be modified by users with the highest level of access where anyone can set their own $PATH because of this it is only safe for it to verify full/absolute paths as someone could add a file called pacman and put it in their path before /usr/bin and now you have allowed them to execute their own pacman command with elevated privileges. I have submitted a PR to make it blow up with a more helpful error message.

from sudo.