# vmd's entire root surface. One path, a fixed verb list inside it, and
# no wildcard that could become a different command.
#
# Deliberately NOT `systemctl` or `zfs` directly: either would be every
# unit or every dataset on this host. `owuivm-ctl` is 80 lines, it is
# array-form throughout, and the one caller-supplied value it accepts is
# pattern-checked before it is used.
owuivmd ALL=(root) NOPASSWD: /usr/local/sbin/owuivm-ctl
Defaults!/usr/local/sbin/owuivm-ctl !requiretty