A Linux/Unix privilege delegation tool using Role-Based Access Control (RBAC) to grant precise capabilities instead of full root access.
RootAsRole is a security-oriented privilege delegation tool for Linux/Unix systems that replaces traditional tools like sudo with a Role-Based Access Control (RBAC) model. It enforces the Principle of Least Privilege by allowing administrators to assign specific Linux capabilities and permissions to users and commands, rather than granting full root access. The tool is designed to be memory-safe, performance-optimized, and scalable for fine-grained access control.
System administrators and DevOps engineers managing Linux/Unix servers who need to enforce strict, granular security policies and replace or supplement sudo with a more secure, role-based model. It is also suitable for security-focused organizations and researchers implementing Principle of Least Privilege at scale.
Developers choose RootAsRole over alternatives like sudo, doas, or setcap because it provides a structured RBAC model with fine-grained command matching, grants only the required Linux capabilities instead of full root, and offers superior performance scaling with large rule sets. Its unique selling point is preventing direct privilege escalation and supporting untrusted authorized users through rigorous access controls.
A better alternative to sudo(-rs)/su • ⚡ Blazing fast • 🛡️ Memory-safe • 🔐 Security-oriented
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements a structured RBAC model with role hierarchy and separation of duties, enabling scalable and precise privilege management beyond simple ACLs like sudo.
Grants specific Linux capabilities such as CAP_NET_RAW instead of full root access, enforcing the Principle of Least Privilege by default for enhanced security.
Uses CBOR for configuration, making it up to 77% faster than sudo with single rules and scaling 40% better as rule sets grow, ideal for automation tools like Ansible.
Prevents direct privilege escalation and supports untrusted authorized users through rigorous access controls, adding layers of security not found in traditional tools.
Includes tools like 'capable' for command rights analysis and 'gensr' for generating policies from Ansible playbooks, simplifying policy management and deployment.
Installation from source requires Rust, git, and clang, adding overhead compared to package-manager installations, and it's not widely available in standard repositories.
Configuring roles and tasks demands understanding of Linux capabilities and RBAC concepts, which can be challenging for teams without dedicated security expertise.
Key features like centralized policy and secure signal forwarding are only planned, limiting some advanced use cases compared to mature alternatives like sudo.
RootAsRole is an open-source alternative to the following products:
doas is a command-line utility for executing commands as another user, primarily used on OpenBSD systems as a simpler alternative to sudo. It provides privilege escalation with a minimal configuration.
sudo-rs is a memory-safe implementation of the sudo command written in Rust, aiming to provide enhanced security and compatibility with traditional sudo.
sudo is a Unix/Linux command-line program that allows users to run commands with the security privileges of another user, typically the superuser.