rootasrole 3.2.1

A better alternative to sudo(-rs)/su
rootasrole-3.2.1 is not a library.

RootAsRole (V3.2.1) — A better alternative to sudo(-rs)/su • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented

RootAsRole is a Linux/Unix privilege delegation tool based on Role-Based Access Control (RBAC). It empowers administrators to assign precise privileges — not full root — to users and commands.

📚 Full Documentation for more details

🚀 Why you need RootAsRole?

Most Linux systems break the Principle of Least Privilege. Tools like sudo give full root, even if you just need one capability like CAP_NET_RAW.

RootAsRole solves this:

  • Grants only the required capabilities
  • Uses roles and tasks to delegate rights securely
  • Better than sudo, doas, setcap, or pam_cap, see Comparison table below

⚙️ Features

📊 Why It’s Better Than Others

Feature setcap?? doas sudo sudo-rs dosr (RootAsRole)
Change user/groups N/A ✅ ✅ ✅ ✅✅ mandatory or optional
Environment variables N/A partial ✅ partial ✅
Specific command matching N/A strict strict & regex strict & wildcard strict & regex
Centralized policy ❌ ❌ ✅ ❌ Planned
Secure signal forwarding N/A ❌ ✅ ✅ Planned
Set capabilities ⚠️ files ❌ ❌ ❌ ✅
Prevent direct privilege escalation ❌ ❌ ❌ ❌ ✅
Untrust authorized users ❌ ❌ ❌ ❌ ✅
Standardized policy format ❌ ❌ ❌ ❌ ✅
Scalable access control model N/A ❌ ACL ❌ ACL ❌ ACL ✅ RBAC

📥 Installation

🔧 From Source

Prerequisites

  • Rust >= 1.76.0
    • You can install Rust by running the following command: 
      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
      (Do not forget to add the cargo bin directory to your PATH with . "$HOME/.cargo/env" command)
  • git
    • You can install git by running the following commands depending on your distribution: Ubuntu : sudo apt-get install git, RedHat : sudo yum install git, ArchLinux : sudo pacman -S git
  • clang (or gcc, but clang is highly recommended)
    • You can install clang by running the following commands depending on your distribution: Ubuntu : sudo apt-get install clang, RedHat : sudo yum install clang, ArchLinux : sudo pacman -S clang

Install Steps

[!WARNING] This installation process configures RaR with all privileges for the user who install the program. See what it does.

  1. git clone https://github.com/LeChatP/RootAsRole
  2. cd RootAsRole
  3. cargo xtask install -bip sudo

Install from Linux distributions

We really need your help to bring the project to Linux distributions repositories! Please contribute 🙏!

🧰 Usage

If you're accustomed to utilizing the sudo tool and find it difficult to break that habit, consider creating an alias :

alias sudo="dosr"
alias sr="dosr"

🏎️ Performance

RootAsRole 3.1.0 introduced CBOR support, significantly boosting performance:

  • ⚡ 77% faster than sudo when using a single rule
  • 📈 Scales 40% better than sudo as more rules are added

Performance comparison

📝 sudo-rs matches sudo performance but crashes with >100 rules (won’t fix for now)

Why Performance Matters

When using Ansible (or any automation tool), every task that uses become: true will invoke dosr on the target host. With RootAsRole (RaR), each role and task introduces additional access control logic --- this doesn’t slow you down.

💡 Here’s the reality: You can reach the performance of 1 sudo rule with ~4000 RaR rules.

That means:

  • You can define thousands of fine-grained rules
  • You enforce better security (POLP) without degrading performance
  • The system stays fast, even at scale

🧱 Configuration

Use the chsr command to:

  • Define roles and tasks
  • Assign them to users or groups

More information in the documentation

Use the capable command to:

  • Analyze specific command rights
  • Generate "credentials" task structure

Use gensr for Ansible to:

  • Auto-generate security policies for your playbooks
  • Detect supply chain attacks by reviewing the generated policy

✅ Compatibility

  • Linux kernel >= 4.3

👥 Contributors

🖼️ Logo

This logo were generated using DALL-E 2 AI, for any license issue or plagiarism, please note that is not intentionnal and don't hesitate to contact us.

📜 Licence notice

This project includes sudo-rs code licensed under the Apache-2 and MIT licenses: We have included cutils.rs, securemem.rs to make work the rpassword.rs file. Indeed, We thought that the password was well managed in this file and we have reused it. As sudo-rs does, rpassword.rs is from the rpassword project (License: Apache-2.0). We use it as a replacement of the rpassword project usage.

🧪 Sponsored research

This project was initiated by IRIT and sponsored by both IRIT and Airbus PROTECT through an industrial PhD during 2022 and 2025.

Link to References