News for hackers. Stuff that matters.
Re:Solaris 11 has the security solution Linus wants for Desk... by rbanffy on Monday March 26, 2012 @09:52AM (#3756650)
"sudo su -" would. You can restrict sudo to give a set of users a limited set of tools, such as restarting specific daemons but not others.
Re:Solaris 11 has the security solution Linus wants for Desk... by binarycrusader on Monday March 26, 2012 @02:20PM (#3757938)
If you'd read the article you discover that sudo's capabilities are far more limited than RBAC's.

For example, RBAC can prevent a process from performing any network operations. Read the blog entry for more information.

Re:Solaris 11 has the security solution Linus wants for Desk... by rbanffy on Monday March 26, 2012 @02:28PM (#3757976)
I didn't say sudo can do everything RBAC can. I said "sudo" would allow Linus to do everything he wanted to do without giving (or even having) a root password.
Re:Solaris 11 has the security solution Linus wants for Desk... by binarycrusader on Monday March 26, 2012 @03:51PM (#3758347)
But you implied that sudo could limit privileges to only those needed for the task based on your reply to the original poster. While sudo can limit the user to only running a utility for printer configuration, as an example, it can't limit the actions of that utility, so my point stands.
Re:Solaris 11 has the security solution Linus wants for Desk... by rbanffy on Monday March 26, 2012 @06:13PM (#3758909)
I wonder if SELinux could be used to accomplish that. IIRC, you can limit actions of programs to a given limited context, but I'm out of my depth.

Still, you don't need to give the root password (Linus' rant) with sudo and you'd have to maliciously use the programs you need to run. So, while in theory, your printer configuration utility could increase your privileges under sudo, I'm not aware of any such printer configuration utilities.