Is it possible to use sudo or some other mechanism to allow a user to only have access to running commands under another specific user account? (i.e. not root?)
I have to provide some level of administrative access over a web tool running under the shell-less account www-data. But on occasion it might be useful for them to be able to run programs as 'www-data' for doing administrative work on the web server. I'm not sure how to allow that while restricting their access to root or other services.
Yes - it is possible to do this with sudo. From the sudoers man page:
A Runas_Spec sets the default for the commands that follow it. What this
means is that for the entry:
dgb boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
The user dgb may run /bin/ls, /bin/kill, and /usr/bin/lprm—but only as
www-dataown those programs, and enable the setuid bit on them.
sudoalready exists to handle.