My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter.
The usual approach would be for me to add that command–user combination to my sudoers file and change the configuration such that the command is executed with sudo. However, I feel that this will give the command in fact many more rights than are needed (I don’t need any write permissions at all).
Is there a sudo-like program that can execute a command as the same user but with the only difference that a particular (pre-defined) file or folder is then accessible? (The file/folder could even have a different name.) Could there be a way to accomplish this with mount namespaces?