3 ms·
If you'd read the article you discover that sudo's capabilities are far more limited than RBAC's. For example, RBAC can prevent a process from performing any n
by binarycrusader 15y ago
If you'd read the article you discover that sudo's capabilities are far more limited than RBAC's.
For example, RBAC can prevent a process from performing any network operations. Read the blog entry for more information.
- rbanffy 15y agoI didn't say sudo can do everything RBAC can. I said "sudo" would allow Linus to do everything he wanted to do without giving (or even having) a root password.
- binarycrusader 15y agoBut you implied that sudo could limit privileges to only those needed for the task based on your reply to the original poster. While sudo can limit the user to only running a utility for printer configuration, as an example, it can't limit the actions of that utility, so my point stands.
- rbanffy 15y agoI wonder if SELinux could be used to accomplish that. IIRC, you can limit actions of programs to a given limited context, but I'm out of my depth. Still, you don't need to give the root password (Linus' rant) with sudo and you'd have to maliciously use the programs you need to run. So, while in theory, your printer configuration utility could increase your privileges under sudo, I'm not aware of any such printer configuration utilities.