Does anybody can use sudo in a way that it adds additional but limited privileges to certain user groups securely? I'm sure it's used only for giving admin privileges to the admin group 99% of the time. If your OS needs a tool that allows users to run processes as another user then maybe your OS needs finer access controls instead.
And for the 99% use case I think a few lines long C code would suffice.
sudo (at least everywhere I've used it) - is typically used to (A) allow me to run code as root without having to type my password, and (B) give select groups of people the rights to run a few specific commands. In terms of number-of-time executed, in a recent environment that I was in, in which approximately 100 or so people had sudo rights, 90+% of the time it was to allow people in various group to run commands like "tcpdump" or "netstat", without giving them full root rights to the system.
The correct way to set up BackupPC to run full disk backups against a remote system is to create a backuppc user on that system and then add an entry to your sudoers file for the most restrictive possible backuppc command. Here's an example from one of my servers:
This primarily is to help limit the amount of damage that backuppc can do if something very strange happens and it decides to try to eat the filesystem.
And for the 99% use case I think a few lines long C code would suffice.