I have a tricky situation with sudoers.
I have an account called oracle
I have created a Cmnd_Alias called "BlockedCommands" and have added "/bin/su - root,/bin/su root,/bin/su, /bin/su -" to that list.
I have granted a user access called x-men to following access
x-men ALL=(root) NOPASSWD :/bin/su - oracle, ALL, !BlockedCommands.
Issue i am facing is, x-men account cannot sudo su - oracle because (i think) its defined in BlockedCommands, which is then restricted for the account.
My Question is,
How can i prevent people from becoming root via (sudo su - root or sudo su root or sudo su or sudo su -), grant ability to issue everyother command and also allow sudo su - oracle.