You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@
14
14
<!-- The project version is managed on json file in resources/rootasrole.json -->
15
15
<!-- markdownlint-restore -->
16
16
17
-
# RootAsRole (V3.2.0) — A better alternative to `sudo(-rs)`/`su` • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
17
+
# RootAsRole (V3.2.1) — A better alternative to `sudo(-rs)`/`su` • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
18
18
19
19
RootAsRole is a Linux/Unix privilege delegation tool based on **Role-Based Access Control (RBAC)**. It empowers administrators to assign precise privileges — not full root — to users and commands.
20
20
@@ -109,7 +109,8 @@ Execute privileged commands with a role-based access control system
109
109
<b>-g, --group</b><GROUP<,GROUP...>> Group(s) to execute the command as
110
110
<b>-E, --preserve-env</b> Keep environment variables from the current process
111
111
<b>-p, --prompt</b><PROMPT> Prompt to display
112
-
<b>-i, --info</b> Display rights of executor
112
+
<b>-K</b> Remove timestamp file
113
+
<b>-i, --info</b> Print the execution context of a commandif allowed by a matching task
113
114
<b>-h, --help</b> Print help (see more with '--help')
If you have a fix, that is most welcome -- please attach or summarize it in your message!
@@ -17,9 +70,12 @@ If there are any vulnerabilities in **RootAsRole**, don't hesitate to _report th
17
70
18
71
## Supported Versions
19
72
20
-
For now, RootAsRole is not distributed widely on repositories because the software is not meant to be production-ready. The objective of 3.0.0 stable version is to be available on linux distributions repositories. So we'll only consider security issues when the software is broadly distributed.
73
+
Here are the supported version for security updates:
74
+
75
+
| Version | Supported | End of support (DD-MM-YYYY format) |
Starting the version 3.2.0, we start following the [Debian Long Term Support](https://wiki.debian.org/LTS) policy. As 3.2.0 is the first version packaged for Debian repository, we updated this table to support only this version and future versions.
Copy file name to clipboardExpand all lines: book/src/HISTORY.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## 1.0.0 (August 2018)
4
4
5
-
RootAsRole initiated by SIERA IRIT CNRS research team with Ahmad Samer WASAN as owner of the proof of concept. It is presented for the first time at "Le capitole du libre" in Toulouse. A paper is published%%cite{wazanRootAsRoleSecureAlternative2021}.
5
+
RootAsRole initiated by SIERA IRIT CNRS research team with Ahmad Samer WAZAN as owner of the proof of concept. It is presented for the first time at "Le capitole du libre" in Toulouse. A paper is published%%cite{wazanRootAsRoleSecureAlternative2021}.
Copy file name to clipboardExpand all lines: book/src/README.md
+3-6Lines changed: 3 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,14 +35,11 @@ In 2022, we published a journal article about our finding with the `capable` too
35
35
36
36
In 2023, we published a third article about explaining linux kernel issues @@billoirImplementingPrincipleLeast2023. This article proposes enhancements to achieving a balance between usability and the principle of least privilege, emphasizing the need for precise capability definitions.
37
37
38
-
In May 2024, we published a more general article about the Administrative privilege on various OS @@billoirImplementingPrincipleLeast2024. This article explores the different approaches implemented by the main operating systems (namely Linux, Windows, FreeBSD, and Solaris) to control the privileges of system administrators in order to enforce the principle of least privilege. We define a set of requirements to manage these privileges properly, striving to balance adherence to the principle of least privilege and usability. We also present a deep analysis of each administrative privilege system based on these requirements and exhibit their benefits and limitations.
38
+
In May 2024, we published a more general article about the Administrative privilege on various OS @@billoirImplementingPrincipleLeast2024. This article explores the different approaches implemented by the main operating systems (namely Linux, Windows, FreeBSD, and Solaris) to control the privileges of system administrators in order to enforce the principle of least privilege.
39
39
40
-
In July 2024, we studied how to integrate RootAsRole on today's production environment as the project becomes a mature project. This article presents a semi-automated process that improves Ansible-based deployments to have fine-grained control on administrative privileges granted to Ansible tasks. This article is not yet published.
41
-
42
-
## Comparison with sudo
43
-
44
-
By using a role-based access control model, this project allows us to better manage administrative tasks. With this project, you could distribute privileges and prevent them from escalating directly. Unlike sudo does, we don't want to give entire privileges for any insignificant administrative task. You can configure our tool easily with `chsr` command. To find out which capability is needed for a administrative command, we provide the `capable` command. With these two tools, administrators could configure its system to respect the least privilege principle.
40
+
In July 2024, we studied how to integrate RootAsRole on today's production environment as the project becomes a mature project. This article presents a semi-automated process that improves Ansible-based deployments to have fine-grained control on administrative privileges granted to Ansible tasks @@billoirImplementingPrincipleLeast2024b.
45
41
42
+
In September 2025, we decided to generalize our RootAsRole policy to all Linux access control mechnanisms. This article presents how we unified DAC, DBus within our RaR policy. This article is being published in September 2025 for the ESORICS conference.
0 commit comments