Skip to content

Commit 6861eee

Browse files
LeChatPLeChatP
committed
fix: there is a bug in the build.rs
1 parent fefc853 commit 6861eee

File tree

1 file changed

+160
-0
lines changed

1 file changed

+160
-0
lines changed

‎README.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,163 @@ RootAsRole is a Linux/Unix privilege delegation tool based on **Role-Based Acces
2626
Most Linux systems break the [Principle of Least Privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege). Tools like `sudo` give **full root**, even if you just need one capability like `CAP_NET_RAW`.
2727

2828
RootAsRole solves this:
29+
- Grants **only the required capabilities**
30+
- Uses **roles and tasks** to delegate rights securely
31+
- Better than `sudo`, `doas`, `setcap`, or `pam_cap`, see Comparison table below
32+
33+
## ⚙️ Features
34+
35+
* [A structured access control model based on Roles](https://dl.acm.org/doi/10.1145/501978.501980)
36+
* [Role hierarchy](https://dl.acm.org/doi/10.1145/501978.501980)
37+
* [Static/Dynamic Separation of Duties](https://dl.acm.org/doi/10.1145/501978.501980)
38+
* [Linux Capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) support
39+
* [Highly configurable](https://lechatp.github.io/RootAsRole/chsr/file-config.html)
40+
* Command matching with [glob](https://docs.rs/glob/latest/glob/) for binary path and [PCRE2](https://www.pcre.org/) for command arguments
41+
* 🛠️ Configuration Helpers:
42+
* [capable](https://github.com/LeChatP/RootAsRole-capable): Analyze command rights
43+
* [gensr](https://github.com/LeChatP/RootAsRole-gensr): Generate policy from Ansible playbooks
44+
45+
## 📊 Why It’s Better Than Others
46+
47+
| Feature | setcap?? | doas | sudo | sudo-rs | dosr (RootAsRole) |
48+
|------------------------------------------|-------------------|------------|--------------------------------|--------------------------------|----------------------------------------------|
49+
| **Change user/groups** | N/A | ✅ | ✅ | ✅ | ✅✅ mandatory or optional |
50+
| **Environment variables** | N/A | partial | ✅ | partial | ✅ |
51+
| **Specific command matching** | N/A | strict | strict & regex | strict & wildcard | strict & regex |
52+
| **Centralized policy** | ❌ | ❌ | ✅ | ❌ | Planned |
53+
| **Secure signal forwarding** | N/A | ❌ | ✅ | ✅ | Planned |
54+
| **Set capabilities** | ⚠️ files | ❌ | ❌ | ❌ | ✅ |
55+
| **Prevent direct privilege escalation** | ❌ | ❌ | ❌ | ❌ | ✅ |
56+
| **Untrust authorized users** | ❌ | ❌ | ❌ | ❌ | ✅ |
57+
| **Standardized policy format** | ❌ | ❌ | ❌ | ❌ | ✅ |
58+
| **Scalable access control model** | N/A | ❌ ACL | ❌ ACL | ❌ ACL | ✅ RBAC |
59+
60+
61+
## 📥 Installation
62+
63+
### 🔧 From Source
64+
65+
### Prerequisites
66+
67+
* [Rust](https://www.rust-lang.org/tools/install) >= 1.76.0
68+
* You can install Rust by running the following command:
69+
```sh
70+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
71+
```
72+
(Do not forget to add the cargo bin directory to your PATH with `. "$HOME/.cargo/env"` command)
73+
* [git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
74+
* You can install git by running the following commands depending on your distribution:
75+
Ubuntu : `sudo apt-get install git`, RedHat : `sudo yum install git`, ArchLinux : `sudo pacman -S git`
76+
* [clang](https://clang.llvm.org/get_started.html) (or gcc, but clang is highly recommended)
77+
* You can install clang by running the following commands depending on your distribution:
78+
Ubuntu : `sudo apt-get install clang`, RedHat : `sudo yum install clang`, ArchLinux : `sudo pacman -S clang`
79+
80+
81+
### Install Steps
82+
83+
84+
> [!WARNING]
85+
> **This installation process configures RaR with all privileges for the user who install the program. See [what it does](https://lechatp.github.io/RootAsRole/guide/installation.html#what-does-the-installation-script-do).**
86+
> 1. `git clone https://github.com/LeChatP/RootAsRole`
87+
> 1. `cd RootAsRole`
88+
> 1. `cargo xtask install -bip sudo`
89+
90+
### Install from Linux distributions
91+
92+
**We really need your help to bring the project to Linux distributions repositories! Please contribute 🙏!**
93+
94+
95+
## 🧰 Usage
96+
97+
<pre>
98+
Execute privileged commands with a role-based access control system
99+
100+
<u><b>Usage</b></u>: <b>dosr</b> [OPTIONS] [COMMAND]...
101+
102+
<u><b>Arguments</b></u>:
103+
[COMMAND]... Command to execute
104+
105+
<u><b>Options</b></u>:
106+
<b>-r, --role</b> &lt;ROLE&gt; Role to select
107+
<b>-t, --task</b> &lt;TASK&gt; Task to select (--role required)
108+
<b>-u, --user</b> &lt;USER&gt; User to execute the command as
109+
<b>-g, --group</b> &lt;GROUP<,GROUP...>&gt; Group(s) to execute the command as
110+
<b>-E, --preserve-env</b> Keep environment variables from the current process
111+
<b>-p, --prompt</b> &lt;PROMPT&gt; Prompt to display
112+
<b>-i, --info</b> Display rights of executor
113+
<b>-h, --help</b> Print help (see more with '--help')
114+
<b>-V, --version</b> Print version
115+
</pre>
116+
117+
If you're accustomed to utilizing the sudo tool and find it difficult to break that habit, consider creating an alias :
118+
```sh
119+
alias sudo="dosr"
120+
alias sr="dosr"
121+
```
122+
123+
## 🏎️ Performance
124+
125+
RootAsRole **3.1.0** introduced **CBOR** support, significantly boosting performance:
126+
127+
- ⚡ **77% faster** than `sudo` when using a single rule
128+
- 📈 **Scales 40% better** than `sudo` as more rules are added
129+
130+
[![Performance comparison](https://github.com/LeChatP/RaR-perf/raw/main/result_25-07-04_15.44.png)](https://github.com/LeChatP/RaR-perf)
131+
132+
> 📝 sudo-rs matches sudo performance but crashes with >100 rules ([won’t fix for now](https://github.com/trifectatechfoundation/sudo-rs/issues/1192))
133+
134+
### Why Performance Matters
135+
136+
When using **Ansible** (or any automation tool), every task that uses `become: true` will invoke `dosr` on the target host.
137+
With **RootAsRole (RaR)**, each role and task introduces additional access control logic --- this doesn’t slow you down.
138+
139+
💡 **Here’s the reality**: You can reach the performance of **1 `sudo` rule** with **~4000 RaR rules**.
140+
141+
That means:
142+
- You can define thousands of fine-grained rules
143+
- You **enforce better security** (POLP) without degrading performance
144+
- The system stays **fast, even at scale**
145+
146+
## 🧱 Configuration
147+
148+
Use the `chsr` command to:
149+
* Define roles and tasks
150+
* Assign them to users or groups
151+
152+
More information in the [documentation](https://lechatp.github.io/RootAsRole/chsr/file-config.html)
153+
154+
Use the [capable](https://github.com/LeChatP/RootAsRole-capable) command to:
155+
* Analyze specific command rights
156+
* Generate "credentials" task structure
157+
158+
Use [gensr](https://github.com/LeChatP/RootAsRole-gensr) for Ansible to:
159+
* Auto-generate security policies for your playbooks
160+
* Detect supply chain attacks by reviewing the generated policy
161+
162+
## ✅ Compatibility
163+
164+
* Linux kernel >= 4.3
165+
166+
## 👥 Contributors
167+
168+
* Eddie Billoir : <[email protected]>
169+
* Ahmad Samer Wazan : <[email protected]>
170+
* Romain Laborde : <[email protected]>
171+
* Rémi Venant: <[email protected]>
172+
* Guillaume Daumas : <[email protected]>
173+
174+
## 🖼️ Logo
175+
176+
This logo were generated using DALL-E 2 AI, for any license issue or plagiarism, please note that is not intentionnal and don't hesitate to contact us.
177+
178+
## 📜 Licence notice
179+
180+
This project includes [sudo-rs](https://github.com/memorysafety/sudo-rs) code licensed under the Apache-2 and MIT licenses:
181+
We have included cutils.rs, securemem.rs to make work the rpassword.rs file. Indeed, We thought that the password was well managed in this file and we have reused it. As sudo-rs does, rpassword.rs is from the rpassword project (License: Apache-2.0). We use it as a replacement of the rpassword project usage.
182+
183+
## 🧪 Sponsored research
184+
185+
This project was initiated by **IRIT** and sponsored by both **IRIT** and **Airbus PROTECT** through an industrial PhD during 2022 and 2025.
186+
187+
188+
## [Link to References](https://lechatp.github.io/RootAsRole/bibliography.html)

0 commit comments

Comments
 (0)