ops ALL=(root) NOPASSWD: \
    NOEXEC: /bin/sh