# Every entry is a literal argv, no wildcards, so callers pass these byte for byte. NOPASSWD is
# deliberate: the account is locked (useradd --system), so requiring a password authenticates
# nothing and only kills sudo.
unifi-talk ALL=NOPASSWD:/bin/systemctl restart freeswitch,/bin/systemctl restart --no-block unifi-talk,/usr/lib/unifi-talk/pcap-capture start,/usr/lib/unifi-talk/pcap-capture stop,/usr/lib/unifi-talk/pcap-capture probe,/usr/lib/unifi-talk/pcap-capture discard
# Runs as freeswitch, not root: it owns the mailbox directories, so chmod needs no root grant.
# The trailing "" forbids arguments, because a sudoers command with no argument list allows any.
unifi-talk ALL=(freeswitch) NOPASSWD:/usr/lib/unifi-talk/voicemail-perms ""
