You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@
14
14
<!-- The project version is managed on json file in resources/rootasrole.json -->
15
15
<!-- markdownlint-restore -->
16
16
17
-
# RootAsRole (V3.1.3) — A better alternative to `sudo(-rs)`/`su` • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
17
+
# RootAsRole (V3.1.3) — A better alternative to `sudo(-rs
18
18
19
19
RootAsRole is a Linux/Unix privilege delegation tool based on **Role-Based Access Control (RBAC)**. It empowers administrators to assign precise privileges — not full root — to users and commands.
Copy file name to clipboardExpand all lines: book/src/README.md
+25-25Lines changed: 25 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,13 +17,13 @@
17
17
18
18
## Usage
19
19
20
-
The main command line tool is `sr`. It allows you to execute a command by simply typing:
20
+
The main command line tool is `dosr`. It allows you to execute a command by simply typing:
21
21
22
22
```bash
23
-
sr<command>
23
+
dosr<command>
24
24
```
25
25
26
-
You can find more information about this command in the [sr](sr/README.md) section.
26
+
You can find more information about this command in the [dosr](sr/README.md) section.
27
27
28
28
The `chsr` command allows you to configure the roles and capabilities of the system. You can find more information about this command in the [Configure RootAsRole](chsr/README.md) section.
29
29
@@ -51,43 +51,43 @@ By using a role-based access control model, this project allows us to better man
51
51
You are using your personal computer and you want to install a new package. By default, RootAsRole add one role with 2 tasks : one task for using `chsr` command that grant only the `CAP_LINUX_IMMUTABLE` capability as `root` user (unprivileged), and one task for all commands but without `CAP_LINUX_IMMUTABLE` privilege. As installing a package may require almost all capabilities, you can use the default role to install a package. Indeed, if you wish to install apache2, you'll need `CAP_NET_BIND_SERVICE`, if you install docker you'll need many privileges, virtualbox needs `CAP_SYS_MODULE`, etc. So, you can use the default role to install a package:
52
52
53
53
```bash
54
-
sr apt install <package>
54
+
dosr apt install <package>
55
55
```
56
56
57
57
### Scenario 2: Granting users the right to restart their system
58
58
59
59
You are the system administrator of a company and you want to delegate the right to restart the server to a user. You can use `chsr` to create a role and grant the right to restart the server to users.
60
60
61
61
```bash
62
-
sr chsr role r_users add # Create a new role
63
-
sr chsr role r_users grant -g users # Grant the role to the group users
64
-
sr chsr role r_users task t_reboot add # Create a new task
65
-
sr chsr role r_users task t_reboot cmd whitelist add reboot # Add the reboot command to the task
66
-
sr chsr role r_users task t_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
62
+
dosr chsr role r_users add # Create a new role
63
+
dosr chsr role r_users grant -g users # Grant the role to the group users
64
+
dosr chsr role r_users task t_reboot add # Create a new task
65
+
dosr chsr role r_users task t_reboot cmd whitelist add reboot # Add the reboot command to the task
66
+
dosr chsr role r_users task t_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
67
67
```
68
68
69
69
Then users can restart the server with the following command:
70
70
71
71
```bash
72
-
sr reboot
72
+
dosr reboot
73
73
```
74
74
75
75
### Scenario 3 : Passing environment variables to a command
76
76
77
77
You are a developer and you want to pass environment variables to a command. For example with sudo you can use the `-E` option to pass environment variables to a command. With RootAsRole, you'll need to setup a role with a task that allows the command to use environment variables. However, as you keep the default configuration, you'll have two roles that matches ANY commands, and if the first one is more restrictive than the second one, you'll need to specify the role to use. Here is an example:
78
78
79
79
```bash
80
-
sr chsr role env add # Create a new role
81
-
sr chsr role env task env add # Create a new task
82
-
sr chsr role env task env cmd setpolicy allow-all # Add all command to the task
83
-
sr chsr role env task env cred caps setpolicy allow-all # Add all capabilities to the task
84
-
sr chsr role env task env o env setpolicy keep-all # Keep the environment variables
80
+
dosr chsr role env add # Create a new role
81
+
dosr chsr role env task env add # Create a new task
82
+
dosr chsr role env task env cmd setpolicy allow-all # Add all command to the task
83
+
dosr chsr role env task env cred caps setpolicy allow-all # Add all capabilities to the task
84
+
dosr chsr role env task env o env setpolicy keep-all # Keep the environment variables
85
85
```
86
86
87
87
Then you can use the following command to pass environment variables to a command:
88
88
89
89
```bash
90
-
sr -r env [command]
90
+
dosr -r env [command]
91
91
```
92
92
93
93
This is because the default role do not keep the environment variables, so if you want to keep environment variables you need to specify the role to use.
@@ -97,26 +97,26 @@ This is because the default role do not keep the environment variables, so if yo
97
97
You are an administrator that want to automatically reboot the system at 04:05 every day with cron for example. You can disable authentication by setting skip-auth in the options. Here is an example:
98
98
99
99
```bash
100
-
sr chsr role auto add # Create a new role
101
-
sr chsr role grant -u cron # Grant the role to the user cron
102
-
sr chsr role auto task cron_reboot add # Create a new task
103
-
sr chsr role auto task cron_reboot cmd whitelist add reboot # Add the reboot command to the task
104
-
sr chsr role auto task cron_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
105
-
sr chsr role auto task cron_reboot o authentication skip # Skip authentication
100
+
dosr chsr role auto add # Create a new role
101
+
dosr chsr role grant -u cron # Grant the role to the user cron
102
+
dosr chsr role auto task cron_reboot add # Create a new task
103
+
dosr chsr role auto task cron_reboot cmd whitelist add reboot # Add the reboot command to the task
104
+
dosr chsr role auto task cron_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
105
+
dosr chsr role auto task cron_reboot o authentication skip # Skip authentication
106
106
```
107
107
108
108
Then you can configure the cron to reboot the system with the following command:
109
109
110
110
```bash
111
-
sr crontab -u cron -e
111
+
dosr crontab -u cron -e
112
112
```
113
113
114
114
and add the following line to reboot the system at 04:05 every day
115
115
116
116
```cron
117
-
5 4 * * * sr -r auto -t cron_reboot reboot
117
+
5 4 * * * dosr -r auto -t cron_reboot reboot
118
118
```
119
119
120
-
Note: You should consider to set the `-r auto -t cron_reboot` options to the `sr` command when you automate a task to avoid any security issue or future conflict.
120
+
Note: You should consider to set the `-r auto -t cron_reboot` options to the `dosr` command when you automate a task to avoid any security issue or future conflict.
121
121
122
122
For a more complete example, you can checkout the [Is a Linux system without root user possible ?](knowledge/no-root.md) section.
Copy file name to clipboardExpand all lines: book/src/dosr/README.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,11 @@
1
-
# What is sr tool
1
+
# What is dosr tool
2
2
3
-
`sr` is the abbrevation of "switch role" is a command line tool like sudo. It allows a permitted user to execute a command as another user and groups. More than sudo it allows to a permitted user to obtain some privileges. The sr command is used to switch to a role.
3
+
`dosr` is the abbrevation of "do switch role" is a command line tool like sudo. It allows a permitted user to execute a command as another user and groups. More than sudo it allows to a permitted user to obtain some privileges. The sr command is used to switch to a role.
0 commit comments