The following happened to me:

 $ sudo su - superman

 Sorry, user clarkkent is not allowed to execute '/bin/su - superman' as root in krypton101.

However the following worked fine:

 $ sudo su superman

When is it useful to allow a user to do `sudo su` but not `sudo su -`? How is this setting set / unset? I read [this page](http://superuser.com/questions/453988/whats-the-difference-between-su-with-and-without-hyphen) but it didn't help.