Switching roles

When a role transition is needed for more than just a couple of commands, it is necessary to open a shell with the new role. This will ensure that the entire session is now running with the new role assigned to it. Every activity performed from within this session will then run with the target role.

How to do it…

Switching roles with sudo or newrole is done as follows:

1. Switching a role can be done using sudo -i or sudo -s if allowed by the sudoers file. If the ROLE and TYPE attributes are set, then the target shell will have the proper context assigned:

   ~$ id -Z
   dbadm_u:staff_r:staff_t:s0
   ~$ sudo -u postgres -i
   Password: 
   ~$ id -Z
   dbadm_u:dbadm_r:dbadm_t:s0
   

2. Switching roles can also be done using newrole:

   ~$ newrole -r dbadm_r
   

How it works…

Getting a shell after switching roles is not all that different from executing commands. However, the SELinux policy might not allow running shells and regular binaries in the target domain. For instance, a user who is allowed the puppetca_t...