Uhm. What about the question ? I'd be interested in that too. A wrapper script is ok, but i'd like to avoid an admin to type a single char more than necessary. Instead, she shouldn't even notice every command is authenticating, and possibly running via sudo. Or maybe SELinux is the way to go, then. (And does anybody know how Mac OSX solved it?)