You can give someone permission to run only certain commands with sudo, but that can be dangerous in non-obvious ways.

As a slightly contrived example, imagine you allow someone to use "apt-get update" with sudo, reasoning that it only changes a local index and doesn't alter the system. You don't allow them to use sudo for anything else.

If they run "sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh" they get a shell that lets them execute any command as root, not just the command you gave them permission for.

Thing is, with sudo you can limit which commands you're able to run. i.e.: regular users can run `sudo` but just the `mount` binary, because they're expected to mount stuff that's not on the fstab (whatever).

That can look safe at first glance, but then you can exploit that binaries to get some other unexpected results:

Change your mount binary for a privileged shell: sudo mount -o bind /bin/sh /bin/mount

Run a privileged shell from inside vim: sudo vi -c ':!/bin/sh' /dev/null

And so on...