RootAsRole
A better alternative to sudo(-rs)/su • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
Install / Use
/learn @LeChatP/RootAsRoleREADME
RootAsRole — A better alternative to sudo(-rs)/su • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
RootAsRole is a Linux/Unix privilege delegation tool based on Role-Based Access Control (RBAC). It empowers administrators to assign precise privileges — not full root — to users and commands.
📚 Full Documentation for more details
🚀 Why you need RootAsRole?
Most Linux systems break the Principle of Least Privilege. Tools like sudo give full root, even if you just need one capability like CAP_NET_RAW.
RootAsRole solves this:
- Grants only the required capabilities
- Uses roles and tasks to delegate rights securely
- Better than
sudo,doas,setcap, orpam_cap, see Comparison table below
⚙️ Features
- A structured access control model based on Roles
- Linux Capabilities support
- Highly configurable
- Command matching with glob for binary path and PCRE2 for command arguments
- 🛠️ Configuration Helpers:
📊 Why It’s Better Than Others
| Feature | setcap?? | doas | sudo | sudo-rs | dosr (RootAsRole) | |------------------------------------------|-------------------|------------|--------------------------------|--------------------------------|----------------------------------------------| | Change user/groups | N/A | ✅ | ✅ | ✅ | ✅✅ mandatory or optional | | Environment variables | N/A | partial | ✅ | partial | ✅ | | Specific command matching | N/A | strict | strict & regex | strict & wildcard | strict & regex | | Centralized policy | ❌ | ❌ | ✅ | ❌ | Planned | | Secure signal forwarding | N/A | ❌ | ✅ | ✅ | Planned | | Set capabilities | ⚠️ files | ❌ | ❌ | ❌ | ✅ | | Prevent direct privilege escalation | ❌ | ❌ | ❌ | ❌ | ✅ | | Untrust authorized users | ❌ | ❌ | ❌ | ❌ | ✅ | | Standardized policy format | ❌ | ❌ | ❌ | ❌ | ✅ | | Scalable access control model | N/A | ❌ ACL | ❌ ACL | ❌ ACL | ✅ RBAC |
📥 Installation
Install from Linux distributions
We really need your help to bring the project to Linux distributions repositories! Please contribute 🙏!
Arch Linux (AUR)
git clone https://aur.archlinux.org/dosr.git
cd dosr
makepkg -si
you can also use yay AUR manager or any other one you like. Please vote for the AUR if you want it into pacman extra repo! All you need is an Arch AUR account and you could vote for the AUR 🙂
🔧 From Source
Prerequisites
- Rust >= 1.83.0
- You can install Rust by running the following command:
(Do not forget to add the cargo bin directory to your PATH withcurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh. "$HOME/.cargo/env"command)
- You can install Rust by running the following command:
- git
- You can install git by running the following commands depending on your distribution:
Ubuntu :
sudo apt-get install git, RedHat :sudo yum install git, ArchLinux :sudo pacman -S git
- You can install git by running the following commands depending on your distribution:
Ubuntu :
- clang (or gcc, but clang is highly recommended)
- You can install clang by running the following commands depending on your distribution:
Ubuntu :
sudo apt-get install clang, RedHat :sudo yum install clang, ArchLinux :sudo pacman -S clang
- You can install clang by running the following commands depending on your distribution:
Ubuntu :
Install Steps
[!WARNING] This installation process configures RaR with all privileges for the user who install the program. See what it does.
git clone https://github.com/LeChatP/RootAsRolecd RootAsRolecargo xtask install -bip sudo
🧰 Usage
<pre> Execute privileged commands with a role-based access control system <u><b>Usage</b></u>: <b>dosr</b> [OPTIONS] [COMMAND]... <u><b>Arguments</b></u>: [COMMAND]... Command to execute <u><b>Options</b></u>: <b>-r, --role</b> <ROLE> Role to select <b>-t, --task</b> <TASK> Task to select (--role required) <b>-u, --user</b> <USER> User to execute the command as <b>-g, --group</b> <GROUP<,GROUP...>> Group(s) to execute the command as <b>-E, --preserve-env</b> Keep environment variables from the current process <b>-p, --prompt</b> <PROMPT> Prompt to display <b>-K</b> Remove timestamp file <b>-i, --info</b> Print the execution context of a command if allowed by a matching task <b>-h, --help</b> Print help (see more with '--help') <b>-V, --version</b> Print version </pre>If you're accustomed to utilizing the sudo tool and find it difficult to break that habit, consider creating an alias :
alias sudo="dosr"
alias sr="dosr"
🏎️ Performance
RootAsRole 3.1.0 introduced CBOR support, significantly boosting performance:
- ⚡ 77% faster than
sudowhen using a single rule - 📈 Scales 40% better than
sudoas more rules are added
📝 sudo-rs matches sudo performance but crashes with >100 rules (won’t fix for now)
Why Performance Matters
When using Ansible (or any automation tool), every task that uses become: true will invoke dosr on the target host.
With RootAsRole (RaR), each role and task introduces additional access control logic --- this doesn’t slow you down.
💡 Here’s the reality: You can reach the performance of 1 sudo rule with ~4000 RaR rules.
That means:
- You can define thousands of fine-grained rules
- You enforce better security (POLP) without degrading performance
- The system stays fast, even at scale
🧱 Configuration
Use the chsr command to:
- Define roles and tasks
- Assign them to users or groups
More information in the documentation
Use the capable command to:
- Analyze specific command rights
- Generate "credentials" task structure
Use gensr for Ansible to:
- Auto-generate security policies for your playbooks
- Detect supply chain attacks by reviewing the generated policy
✅ Compatibility
- Linux kernel >= 4.3
👥 Contributors
- Eddie Billoir : eddie.billoir@gmail.com
- Ahmad Samer Wazan : ahmad.wazan@zu.ac.ae
- Romain Laborde : laborde@irit.fr
- Rémi Venant: remi.venant@gmail.com
- Guillaume Daumas : guillaume.daumas@univ-tlse3.fr
🖼️ Logo
This logo were generated using DALL-E 2 AI, for any license issue or plagiarism, please note that is not intentionnal and don't hesitate to contact us.
