http://askubuntu.com/questions/90726/is-it-possible-to-give-sudo-access-to-only-a-particular-command
# Make a new group, web (call it what you wish) sudo addgroup web # Add your developer(s) to the web group (use their login name). sudo usermod -a -G web your_developer(s) # Then run sudo visudo # Add in a line %web ALL=(ALL) /usr/bin/service apache2 * # The developers can then run sudo service apache2 * **Do NOT add your admin user to the web group**
Disable coredump
sysctl -w kernel.core_pattern=|/bin/false ulimit -c 0
Ref https://www.kernel.org/doc/Documentation/sysctl/kernel.txt