Here is my situation: our webservice is made up of about 30 microservices. They all have different names (of course), and are in an rpm group called Applications/Blah. I want to allow our users to be able to start/stop/restart/etc rpms in this rpm group only. And I want to create a global sudo rule (via FreeIPA) that would enforce this on every machine. Something like this:machine1 $ rpm -q --queryformat %{NAME}\n -g Applications/Blah$ name_of_application_1machine2 $ rpm -q --queryformat %{NAME}\n -g Applications/Blah$ name_of_application_2anymachine $ sudo service `rpm -q --queryformat %{NAME}\n -g Applications/Blah` status$ runningIs it possible to create a sudo rule like the above command? I have no idea of you can nest commands in sudo rules. It seems dangerous. Alternatively I can put down a file in sudoers.d on every machine that has all 30 names of these microservices, but that defeats the purpose of having a system where these sudo rules get centrally managed (freeIPA). Any ideas? Cheers and thanks. 
Setting up a sudoers rule to manage services of rpms in a certain rpm group
sudo;rpm;group