RootAsRole: Towards a Secure Alternative to sudo/su Commands for Home Users and SME Administrators - Archive ouverte HAL Access content directly
Conference Papers Year : 2021

RootAsRole: Towards a Secure Alternative to sudo/su Commands for Home Users and SME Administrators

Abstract

The typical way to run an administrative task on Linux is to execute it in the context of a super user. This breaks the principle of least privilege on access control. Other solutions, such as SELinux and AppArmor, are available but complex to use. In this paper, a new Linux module, named RootAsRole, is proposed to allow users to fine-grained control the privileges they grant to Linux commands as capabilities. It adopts a role-based access control (RBAC) [14], in which administrators can define a set of roles and the capabilities that are assigned to them. Administrators can then define the rules controlling what roles users or groups can assign to themselves. Each time a Linux user wants to execute a program that necessitates one or more capabilities, (s)he should assign the role to him/herself that contains the needed capabilities, providing there is a rule that allows it. A pilot implementation on Linux systems is illustrated in detail.
Embargoed file
Embargoed file
0 6 26
Year Month Jours
Avant la publication

Dates and versions

hal-03345757 , version 1 (05-08-2022)

Licence

Attribution

Identifiers

Cite

Ahmad Samer Wazan, David Chadwick, Remi Venant, Romain Laborde, Abdelmalek Benzekri. RootAsRole: Towards a Secure Alternative to sudo/su Commands for Home Users and SME Administrators. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC 2021), IFIP : International Federation for Information Processing, Jun 2021, Oslo, Norway. pp.196-209, ⟨10.1007/978-3-030-78120-0_13⟩. ⟨hal-03345757⟩
206 View
1 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More