Note to self. In /etc/sudoers.d/something:
foo ALL = (bar) NOPASSWD: /bin/ls
means that user foo, any any host (ALL), gets to run /bin/ls as user bar without providing a password.