Use case 1:
A dhis2-admin user wants to download the backup files located in /var/lib/dhis2/dhis/backups, or generate and download an ad-hoc db backup generated by the dhis () user.
Problem. Currently the dhis2-admins don't have access to files in the backups/ folder, so the only way right now is to use sudo. And ad-hoc backup can be taken using "sudo -u dhis pg_dump XXX", but this file must be written to a folder where the dhis user has access (not possible to write the backup to /home/), and the dhis2-admin user will not have access to that location.
Need to change the way that automatic backups are done. It is not right that they should run as the dhis2 application user. If the user is compromised, so is access to the backups.
Use case 1: A dhis2-admin user wants to download the backup files located in /var/lib/dhis2/dhis/backups, or generate and download an ad-hoc db backup generated by the dhis () user.
Problem. Currently the dhis2-admins don't have access to files in the backups/ folder, so the only way right now is to use sudo. And ad-hoc backup can be taken using "sudo -u dhis pg_dump XXX", but this file must be written to a folder where the dhis user has access (not possible to write the backup to /home/), and the dhis2-admin user will not have access to that location.