Implementing the Principle of Least Privilege Using Linux Capabilities: Challenges and Perspectives - Archive ouverte HAL Access content directly
Conference Papers Year : 2023

Implementing the Principle of Least Privilege Using Linux Capabilities: Challenges and Perspectives

Abstract

Historically and by default, Linux does not respect the principle of least privilege because it grants all the privileges to administrators to execute their tasks. With the new personal data protection or export control regulations, the principle of least privilege is mandatory and must be applied even for system administrators. The Linux operating system since version 2.2 divides the privileges associated with the superuser into distinct units called capabilities. Linux capabilities allow coarse-grained access control to restricted system features. The “RootAsRole” project is introduced as a solution for delegating administrative tasks while matching the necessary capabilities. However, limitations in user experience and the mapping of Linux capabilities pose significant obstacles. This paper proposes enhancements to achieving a balance between usability and the principle of least privilege, emphasizing the need for precise capability definitions. Future work involves enhancing the RootAsRole access control model and addressing the need for a comprehensive administration access control framework for managing Linux capabilities effectively.
No file

Dates and versions

hal-04278090 , version 1 (09-11-2023)

Licence

Attribution

Identifiers

  • HAL Id : hal-04278090 , version 1

Cite

Eddie Billoir, Romain Laborde, Ahmad Samer Wazan, Yves Rütschlé, Abdelmalek Benzekri. Implementing the Principle of Least Privilege Using Linux Capabilities: Challenges and Perspectives. 7th Cyber Security in Networking Conference (CSNet 2023), IEEE Communications Society, Oct 2023, Montréal, Canada. à paraître. ⟨hal-04278090⟩
53 View
0 Download

Share

Gmail Facebook X LinkedIn More