I currently expose some ec2 instances to some users via ssm. The instance assigns the selinux user system_u:system_r:unconfined_service_t:s0. For audit purposes, I want to force users to sign in using their individual account which is assigned the selinux user staff_u. I already have a script that forces users to switch to their user with su - <username>; however, they are not able to run sudo commands because they still have the selinux context from the ssm-user. The error received is:

sudo: system_u:sysadm_r:sysadm_t:s0 is not a valid context

I tried using sudo -r staff_r -u <user> -s, but I get the same invalid context error.
It seems that what I need is to transition context from system_r to sysadm_r. I’ve been trying to create a selinux policy for transitioning to the staff_t or sysadm_t domains, but haven’t had any luck yet. I’m pretty new to selinux, so I may be making some bad assumptions or miss-understanding the error.

Any help would be greatly appreciated. I am trying to do this on rhel7 (I know, soon out of maintenance), but I’ve tested on AL2 and had the same issue.

Appreciate any help.