#!/bin/bash
# only allow read-only rsync, BUT elevated so all application data is readable.
case "$SSH_ORIGINAL_COMMAND" in
    "rsync --server --sender "*)
        exec sudo /usr/bin/rsync ${SSH_ORIGINAL_COMMAND#rsync }
        ;;
    *)
        echo "backup key only permits read-only rsync" >&2
        exit 1
        ;;
esac