Running commands in a specified role with sudo

When a user has been assigned multiple roles, they usually work with their primary role (such as staff_r) and only selectively execute commands with the other role. This can be accomplished through the sudo command, as these commands usually also require a different Linux user (which can be root or the postgresql account for DBA tasks on the PostgreSQL database server).

How to do it…

In order to configure sudo to perform the right role and type transition, execute the following steps:

1. Open up the sudoers file through visudo:

   ~# visudo
   

2. Define the commands that the user(s) are allowed to execute. For instance, to allow all users in the dba group to call initdb in the dbadm_r role, define the commands as follows:

   %dba ALL=(postgres) ROLE="dbadm_r" TYPE="dbadm_t" /usr/sbin/initdb

3. The users in the dba group can now call initdb, and sudo will automatically switch to the dbadm_r role and the dbadm_t user domain when initdb is called:

   ~$ sudo -u postgres...