For maintainability I'd love to be able to specify group names in addition to GIDs for gids_exempted. My rust-foo is superficial at best but I'm thinking this should be doable by extending is_sudoing_from_exempted_gid() , what do you think?