Alas you are not wrong. Due to the way sudoers is parsed you really need to iterate through the entire thing. It may be possible to work around much of this by 'compiling' sudoers into an intermediate format with some things expanded but features like the wildcard support makes things difficult. - todd