Grant non-admin sudo privilege, but with `~` being his own home~
There is a flaw in bruce's home folder probably: the permissions of ~/Library/Preferences/Preferences are wrong. Therefore the script doesn't work as expected.

Check the following output in my environment executing the script logged in as admin. I slightly modified the script and replaced ls ~/Library/Preferences/Preferences by ls -la ~/Library/Preferences | grep "loginwindow"

/Users/bruce/bin/sh/test-env.sh
batman
/Users/batman
-rw-------    1 batman  staff     192 27 Nov 13:42 com.apple.loginwindow.plist
-rw-------    1 batman  staff     198 24 Okt 21:43 loginwindow.plist

sudo /Users/bruce/bin/sh/test-env.sh
root
/Users/batman
-rw-------    1 batman  staff     192 27 Nov 13:42 com.apple.loginwindow.plist
-rw-------    1 batman  staff     198 24 Okt 21:43 loginwindow.plist

sudo -i -u bruce /Users/bruce/bin/sh/test-env.sh
bruce
/Users/bruce
-rw-------    1 bruce  staff      95 27 Nov 13:40 com.apple.loginwindow.plist
-rw-------    1 bruce  staff     198 27 Nov 13:36 loginwindow.plist

sudo su bruce
/Users/bruce/bin/sh/test-env.sh
bruce
/Users/bruce
-rw-------    1 bruce  staff      95 27 Nov 13:40 com.apple.loginwindow.plist
-rw-------    1 bruce  staff     198 27 Nov 13:36 loginwindow.plist
$USERNAME = root #check this by entering `env` in the shell additionally

sudo su -l bruce
/Users/bruce/bin/sh/test-env.sh
bruce
/Users/bruce
-rw-------    1 bruce  staff      95 27 Nov 13:40 com.apple.loginwindow.plist
-rw-------    1 bruce  staff     198 27 Nov 13:36 loginwindow.plist
$USERNAME = &lt;empty&gt;




Also: there is a major misunderstanding how sudo/su really works. Your admin batman never runs a command "on behalf" of another user. If you enter "sudo some_command" or "sudo -i -u user some_command" it's always the super user's elevated position (and the privilege of an admin to run sudo as determined by the sudoers file and "make himself super user" temporarily) which "executes the command successfully on behalf of another user".

If you have to execute commands with escalated privileges on a daily base with your non-admin user, add him to the sudoers file and add a restricted number of commands only.

Example (control Apache web server):

bruce ALL=(ALL) /usr/sbin/apachectl


or without the requirement to enter a password after executing sudo apachectl as bruce:

bruce ALL=(ALL) NOPASSWD: /usr/sbin/apachectl


Or modify the scripts appropriately to stay within bruce's realm.

That said the advice/practice that "the daily user shouldn't be a sudoer" is still valid.



Homebrew is a different beast: it's designed to be installed by one user only - an admin user. Most apps/executables provided by the homebrew environment can be launched by a standard user after modifying the user's $PATH though or using the full path.

Several how-tos exist how to set up homebrew as a multi-user environment (e.g. My Homebrew Multi User Setup). I don't know if this still applies to newer OS X systems/brew versions.