Skip to Main content Skip to Navigation
Conference papers

RootAsRole: Towards a Secure Alternative to sudo/su Commands for Home Users and SME Administrators

Abstract : The typical way to run an administrative task on Linux is to execute it in the context of a super user. This breaks the principle of least privilege on access control. Other solutions, such as SELinux and AppArmor, are available but complex to use. In this paper, a new Linux module, named RootAsRole, is proposed to allow users to fine-grained control the privileges they grant to Linux commands as capabilities. It adopts a role-based access control (RBAC) [14], in which administrators can define a set of roles and the capabilities that are assigned to them. Administrators can then define the rules controlling what roles users or groups can assign to themselves. Each time a Linux user wants to execute a program that necessitates one or more capabilities, (s)he should assign the role to him/herself that contains the needed capabilities, providing there is a rule that allows it. A pilot implementation on Linux systems is illustrated in detail.
Complete list of metadata

https://ifip.hal.science/hal-03345757
Contributor : Romain Laborde Connect in order to contact the contributor
Submitted on : Friday, August 5, 2022 - 9:37:48 AM
Last modification on : Monday, August 22, 2022 - 3:51:00 PM

File

 Restricted access
To satisfy the distribution rights of the publisher, the document is embargoed until : 2024-01-01

Please log in to resquest access to the document

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Ahmad Samer Wazan, David Chadwick, Remi Venant, Romain Laborde, Abdelmalek Benzekri. RootAsRole: Towards a Secure Alternative to sudo/su Commands for Home Users and SME Administrators. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC 2021), IFIP : International Federation for Information Processing, Jun 2021, Oslo, Norway. pp.196-209, ⟨10.1007/978-3-030-78120-0_13⟩. ⟨hal-03345757⟩

Share

Metrics

Record views

106