You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@
14
14
<!-- The project version is managed on json file in resources/rootasrole.json -->
15
15
<!-- markdownlint-restore -->
16
16
17
-
# RootAsRole (V3.1.3) — A better alternative to `sudo(-rs
17
+
# RootAsRole (V3.1.3) — A better alternative to `sudo(-rs)`/`su` • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
18
18
19
19
RootAsRole is a Linux/Unix privilege delegation tool based on **Role-Based Access Control (RBAC)**. It empowers administrators to assign precise privileges — not full root — to users and commands.
Copy file name to clipboardExpand all lines: book/src/README.md
+25-25Lines changed: 25 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,13 +17,13 @@
17
17
18
18
## Usage
19
19
20
-
The main command line tool is `dosr`. It allows you to execute a command by simply typing:
20
+
The main command line tool is `sr`. It allows you to execute a command by simply typing:
21
21
22
22
```bash
23
-
dosr<command>
23
+
sr<command>
24
24
```
25
25
26
-
You can find more information about this command in the [dosr](sr/README.md) section.
26
+
You can find more information about this command in the [sr](sr/README.md) section.
27
27
28
28
The `chsr` command allows you to configure the roles and capabilities of the system. You can find more information about this command in the [Configure RootAsRole](chsr/README.md) section.
29
29
@@ -51,43 +51,43 @@ By using a role-based access control model, this project allows us to better man
51
51
You are using your personal computer and you want to install a new package. By default, RootAsRole add one role with 2 tasks : one task for using `chsr` command that grant only the `CAP_LINUX_IMMUTABLE` capability as `root` user (unprivileged), and one task for all commands but without `CAP_LINUX_IMMUTABLE` privilege. As installing a package may require almost all capabilities, you can use the default role to install a package. Indeed, if you wish to install apache2, you'll need `CAP_NET_BIND_SERVICE`, if you install docker you'll need many privileges, virtualbox needs `CAP_SYS_MODULE`, etc. So, you can use the default role to install a package:
52
52
53
53
```bash
54
-
dosr apt install <package>
54
+
sr apt install <package>
55
55
```
56
56
57
57
### Scenario 2: Granting users the right to restart their system
58
58
59
59
You are the system administrator of a company and you want to delegate the right to restart the server to a user. You can use `chsr` to create a role and grant the right to restart the server to users.
60
60
61
61
```bash
62
-
dosr chsr role r_users add # Create a new role
63
-
dosr chsr role r_users grant -g users # Grant the role to the group users
64
-
dosr chsr role r_users task t_reboot add # Create a new task
65
-
dosr chsr role r_users task t_reboot cmd whitelist add reboot # Add the reboot command to the task
66
-
dosr chsr role r_users task t_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
62
+
sr chsr role r_users add # Create a new role
63
+
sr chsr role r_users grant -g users # Grant the role to the group users
64
+
sr chsr role r_users task t_reboot add # Create a new task
65
+
sr chsr role r_users task t_reboot cmd whitelist add reboot # Add the reboot command to the task
66
+
sr chsr role r_users task t_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
67
67
```
68
68
69
69
Then users can restart the server with the following command:
70
70
71
71
```bash
72
-
dosr reboot
72
+
sr reboot
73
73
```
74
74
75
75
### Scenario 3 : Passing environment variables to a command
76
76
77
77
You are a developer and you want to pass environment variables to a command. For example with sudo you can use the `-E` option to pass environment variables to a command. With RootAsRole, you'll need to setup a role with a task that allows the command to use environment variables. However, as you keep the default configuration, you'll have two roles that matches ANY commands, and if the first one is more restrictive than the second one, you'll need to specify the role to use. Here is an example:
78
78
79
79
```bash
80
-
dosr chsr role env add # Create a new role
81
-
dosr chsr role env task env add # Create a new task
82
-
dosr chsr role env task env cmd setpolicy allow-all # Add all command to the task
83
-
dosr chsr role env task env cred caps setpolicy allow-all # Add all capabilities to the task
84
-
dosr chsr role env task env o env setpolicy keep-all # Keep the environment variables
80
+
sr chsr role env add # Create a new role
81
+
sr chsr role env task env add # Create a new task
82
+
sr chsr role env task env cmd setpolicy allow-all # Add all command to the task
83
+
sr chsr role env task env cred caps setpolicy allow-all # Add all capabilities to the task
84
+
sr chsr role env task env o env setpolicy keep-all # Keep the environment variables
85
85
```
86
86
87
87
Then you can use the following command to pass environment variables to a command:
88
88
89
89
```bash
90
-
dosr -r env [command]
90
+
sr -r env [command]
91
91
```
92
92
93
93
This is because the default role do not keep the environment variables, so if you want to keep environment variables you need to specify the role to use.
@@ -97,26 +97,26 @@ This is because the default role do not keep the environment variables, so if yo
97
97
You are an administrator that want to automatically reboot the system at 04:05 every day with cron for example. You can disable authentication by setting skip-auth in the options. Here is an example:
98
98
99
99
```bash
100
-
dosr chsr role auto add # Create a new role
101
-
dosr chsr role grant -u cron # Grant the role to the user cron
102
-
dosr chsr role auto task cron_reboot add # Create a new task
103
-
dosr chsr role auto task cron_reboot cmd whitelist add reboot # Add the reboot command to the task
104
-
dosr chsr role auto task cron_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
105
-
dosr chsr role auto task cron_reboot o authentication skip # Skip authentication
100
+
sr chsr role auto add # Create a new role
101
+
sr chsr role grant -u cron # Grant the role to the user cron
102
+
sr chsr role auto task cron_reboot add # Create a new task
103
+
sr chsr role auto task cron_reboot cmd whitelist add reboot # Add the reboot command to the task
104
+
sr chsr role auto task cron_reboot cred caps whitelist add CAP_SYS_BOOT # Add the CAP_SYS_BOOT capability to the task
105
+
sr chsr role auto task cron_reboot o authentication skip # Skip authentication
106
106
```
107
107
108
108
Then you can configure the cron to reboot the system with the following command:
109
109
110
110
```bash
111
-
dosr crontab -u cron -e
111
+
sr crontab -u cron -e
112
112
```
113
113
114
114
and add the following line to reboot the system at 04:05 every day
115
115
116
116
```cron
117
-
5 4 * * * dosr -r auto -t cron_reboot reboot
117
+
5 4 * * * sr -r auto -t cron_reboot reboot
118
118
```
119
119
120
-
Note: You should consider to set the `-r auto -t cron_reboot` options to the `dosr` command when you automate a task to avoid any security issue or future conflict.
120
+
Note: You should consider to set the `-r auto -t cron_reboot` options to the `sr` command when you automate a task to avoid any security issue or future conflict.
121
121
122
122
For a more complete example, you can checkout the [Is a Linux system without root user possible ?](knowledge/no-root.md) section.
Copy file name to clipboardExpand all lines: book/src/knowledge/no-root.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,35 +3,35 @@
3
3
To make it short, not really. But you can design your system to never have to use the root user. This is what RootAsRole aims, and the exact purpose of Linux Capabilities. Let's consider you want a system without root user and you want to setup a webserver. Firstly, let's create the apache2 user and group:
4
4
5
5
```bash
6
-
dosr adduser apache2
6
+
sr adduser apache2
7
7
```
8
8
9
9
We consider that we still use the default configuration of RootAsRole. Then, let's add a task to install apache2 with the apache2 user:
10
10
11
11
```bash
12
-
dosr chsr r r_root t install_apache2 add
13
-
dosr chsr r r_root t install_apache2 cmd whitelist add apt install apache2
14
-
dosr chsr r r_root t install_apache2 cmd whitelist add "apt upgrade( -y)? apache2"
15
-
dosr chsr r r_root t install_apache2 cred set --caps CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_NET_BIND_SERVICE,CAP_SETUID --setuid apache2 --setgid apache2
12
+
sr chsr r r_root t install_apache2 add
13
+
sr chsr r r_root t install_apache2 cmd whitelist add apt install apache2
14
+
sr chsr r r_root t install_apache2 cmd whitelist add "apt upgrade( -y)? apache2"
15
+
sr chsr r r_root t install_apache2 cred set --caps CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_NET_BIND_SERVICE,CAP_SETUID --setuid apache2 --setgid apache2
16
16
```
17
17
18
18
Then, let's add a task to start apache2 with the apache2 user:
19
19
20
20
```bash
21
-
dosr chsr r r_root t start_apache2 add
22
-
dosr chsr r r_root t start_apache2 cmd whitelist add "systemctl ((re)?start|stop) apache2"
23
-
dosr chsr r r_root t start_apache2 cmd whitelist add "service apache2 ((re)?start|stop)"
24
-
dosr chsr r r_root t install_apache2 cred set --caps CAP_NET_BIND_SERVICE,CAP_SETUID --setuid apache2 --setgid apache2
21
+
sr chsr r r_root t start_apache2 add
22
+
sr chsr r r_root t start_apache2 cmd whitelist add "systemctl ((re)?start|stop) apache2"
23
+
sr chsr r r_root t start_apache2 cmd whitelist add "service apache2 ((re)?start|stop)"
24
+
sr chsr r r_root t install_apache2 cred set --caps CAP_NET_BIND_SERVICE,CAP_SETUID --setuid apache2 --setgid apache2
25
25
```
26
26
27
27
So now you can install and start apache2 with the apache2 user:
28
28
29
29
```bash
30
-
dosr apt install apache2
30
+
sr apt install apache2
31
31
```
32
32
33
33
This should install apache2 configuration files owned by apache2 user and group. Then you can start apache2 with the apache2 user:
0 commit comments