rdiff-backup: only allow sudo for the backup command