[arch-devops] restricting sudoers PATH