In my experience, if you see * or more rarely ? in a sudo command configuration then there's a good chance there's a problem. I once saw a bunch of systemctl s

In my experience, if you see * or more rarely ? in a sudo command configuration then there's a good chance there's a problem. I once saw a bunch of systemctl start someprefix* being allowed in a sudoers configuration (likewise for stop). systemctl can start more than one service at a time and the way that the sudoers configuration is checked is by glob matching the concatenated command. If your command is literally: "systemctl" "start" "someprefix" "sshd" this gets concatenated to "systemctl start someprefix sshd" which matches the glob "systemctl start someprefix*".