Jesús Daniel Colmenares Oviedo
23c19ba170
privleap is a privilege escalation framework similar in purpose to sudo and doas, but very different conceptually. It is designed to allow user-level applications to run very specific operations as root without allowing full root control of the machine. Unlike directly executable privilege escalation frameworks like sudo, privleap runs as a background service that listens for signals from other applications. Each signal can request a particular, pre-configured action to be taken. Signals are authenticated, and each action is taken only if the signal passes authentication. Any console output from the action is then returned to the caller. This system allows privleap to function without being SUID-root, and avoids a lot of the potential pitfalls of sudo, doas, run0, etc. WWW: https://www.kicksecure.com/wiki/Privleap
12 lines
289 B
Plaintext
12 lines
289 B
Plaintext
[
|
|
{ type: install
|
|
message: <<EOM
|
|
pam_exec(8) could be used to call leapctl(8) to create the
|
|
communication socket required by leaprun(8) by simply adding
|
|
the following to a PAM policy file:
|
|
|
|
session optional pam_exec.so /usr/local/libexec/privleap/pam_create_socket.sh
|
|
EOM
|
|
}
|
|
]
|