You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+24-4Lines changed: 24 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@
16
16
<!-- The project version is managed on json file in resources/rootasrole.json -->
17
17
<!-- markdownlint-restore -->
18
18
19
-
# RootAsRole (V3.0.6) : A memory-safe and security-oriented alternative to sudo/su commands
19
+
# RootAsRole (V3.1.0) : A memory-safe and security-oriented alternative to sudo/su commands
20
20
21
21
**RootAsRole** is a project to allow Linux/Unix administrators to delegate their administrative tasks access rights to users. Its main features are :
22
22
@@ -29,13 +29,15 @@
29
29
* File relocation ability.
30
30
* Multi-layered and inheritable execution environment configuration.
31
31
* Interoperable and evolvable by using [JSON](https://www.json.org/) as the main configuration file format.
32
+
* Interchangeable file format with [JSON5](https://www.json.org/) and [CBOR](https://cbor.io/) for performance and human readability.
33
+
* Setuid managed by set of users or (set-of-)groups (all-and-deny, or nothing-then-grant), Thanks to @[hocineait7](https://github.com/hocineait7).
32
34
* Command matching based on commonly-used open-source libraries:
33
-
*[glob](https://docs.rs/glob/latest/glob/) for binary path
35
+
*[glob](https://docs.rs/glob/latest/glob/) for binary pathv
34
36
*[PCRE2](https://www.pcre.org/) for command arguments
35
37
36
38
If you need help to configure a RootAsRole policy, you can use our **[capable tool](https://github.com/LeChatP/RootAsRole-capable)**. This tool identifies the rights required by specific commands, making it easier to define a precise policy.
37
39
38
-
For administrators who already use **Ansible playbooks** for their tasks and wish to implement **RootAsRole**, our tool [gensr](https://github.com/LeChatP/RootAsRole-utils) can generate an initial draft of a **RootAsRole policy**. The `gensr` tool works by running your Ansible playbook alongside the [capable tool](https://github.com/LeChatP/RootAsRole-capable), creating a draft policy based on the observed required rights. This process helps administrators to harden their Ansible tasks. It helps to verify eventual third-party supply-chain attacks.
40
+
For administrators who already use **Ansible playbooks** for their tasks and wish to implement RootAsRole, our tool [gensr](https://github.com/LeChatP/RootAsRole-utils) can generate an initial draft of a RootAsRole policy. The `gensr` tool works by running your Ansible playbook alongside the [capable tool](https://github.com/LeChatP/RootAsRole-capable), creating a draft policy based on the observed required rights. This process helps administrators to harden their Ansible tasks. It helps to verify eventual **third-party supply-chain attacks**.
39
41
40
42
**Note:** The `gensr` tool is still in development and may not work with all playbooks. If you wish to contribute to this project, feel free to make issues and pull requests.
41
43
@@ -105,6 +107,9 @@ Execute privileged commands with a role-based access control system
105
107
<u><b>Options</b></u>:
106
108
<b>-r, --role</b><ROLE> Role to select
107
109
<b>-t, --task</b><TASK> Task to select(--role required)
110
+
<b>-u, --user</b><USER> User to execute the command as
111
+
<b>-g, --group</b><GROUP<,GROUP...>> Group(s) to execute the command as
112
+
<b>-E, --preserve-env</b> Keep environment variables from the current process
108
113
<b>-p, --prompt</b><PROMPT> Prompt to display
109
114
<b>-i, --info</b> Display rights of executor
110
115
<b>-h, --help</b> Print help (see more with '--help')
@@ -116,7 +121,22 @@ If you're accustomed to utilizing the sudo tool and find it difficult to break t
116
121
alias sudo="sr"
117
122
```
118
123
119
-
However you won't find out exact same options as sudo, you can use the `--role` option to specify the role you want to use instead.
Since RootAsRole 3.1.0, the project introduced CBOR file format, consequently the performance of the `sr` command has been significantly improved. The new version now outperforms the `sudo` command by a raw 77% (with 1 rule each side), and more you add rules, more the performance gap increases. The slope between the `sudo` and `sr` commands is 40% better, meaning that the more rules you add, the more the `sr` command will outperform the `sudo` command. You can reproduce this performance test by following the [RaR-perf](https://github.com/LeChatP/RaR-perf) repository guideline.
129
+
130
+
The performance of `sudo-rs` are actually even-or-worse than `sudo` command for the few tests I was able to do. However, the sudo-rs project is crashing when you try to add more than 100 rules. [I created an issue on their repository, but it's tagged as won't fix](https://github.com/trifectatechfoundation/sudo-rs/issues/1192).
131
+
132
+
But that is not all, as we wish to introduce RDBMS (Relational Database Management System) support in the future (with Limbo SQLite and regular DBMS solutions), the performance will be even better.
133
+
134
+
135
+
### Why Performance Matters
136
+
137
+
When it comes to managing infrastructure with tools like Ansible, executing privileged commands will become a common task, so you multiply the number of commands executed by the number of rules. With the `sudo` command, it didn't matters as long you had only one rule everywhere, but now with RootAsRole, you can have a lot of rules as long you configure it with `gensr` --- generating a first version of a very-specific policy --- thus increasing the number of rules inside the policy, so the performance of the `sr`command now matters.
138
+
139
+
With RootAsRole, you add more access control rules, enforcing a better POLP, without sacrificing performance.
This command will read the JSON file, convert it to CBOR format, and save it to `/etc/security/rootasrole.bin`. The `-r` option changes the file `/etc/security/rootasrole.json` to specify the new location in `path` field of the configuration file.
10
+
11
+
To convert the CBOR file back to JSON format, you can use the following command:
This command will read the CBOR file, convert it back to JSON format, and save it to `/etc/security/rootasrole.json`. The `-r` option changes the file `/etc/security/rootasrole.json` to specify the new location in `path` field of the configuration file.
0 commit comments