{"id":51763591,"url":"https://github.com/vercingetorx/elevate","last_synced_at":"2026-07-19T16:33:57.967Z","repository":{"id":323091711,"uuid":"1092099091","full_name":"vercingetorx/elevate","owner":"vercingetorx","description":"Aggressively simple and secure Rust setuid helper","archived":false,"fork":false,"pushed_at":"2026-01-21T02:03:10.000Z","size":16,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-21T13:41:26.632Z","etag":null,"topics":["authentication","doas","rust","rust-lang","setuid","sudo"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vercingetorx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-08T01:58:40.000Z","updated_at":"2026-01-21T02:03:14.000Z","dependencies_parsed_at":"2025-11-08T04:05:17.472Z","dependency_job_id":null,"html_url":"https://github.com/vercingetorx/elevate","commit_stats":null,"previous_names":["vercingetorx/elevate"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/vercingetorx/elevate","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Felevate","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Felevate/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Felevate/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Felevate/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vercingetorx","download_url":"https://codeload.github.com/vercingetorx/elevate/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vercingetorx%2Felevate/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35659409,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-19T02:00:06.923Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","doas","rust","rust-lang","setuid","sudo"],"created_at":"2026-07-19T16:33:56.905Z","updated_at":"2026-07-19T16:33:57.941Z","avatar_url":"https://github.com/vercingetorx.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# elevate\n\n`elevate` is a ruthlessly small replacement for `sudo` whose only job is to execute a single command as root on Linux. No configurable policy engine, no configuration files, no ambient environment leakage—just a safe trampoline into a target program.\n\n### Why it’s safe\n\n`elevate` keeps the privilege boundary tight by forcing every caller to re-enter their UNIX password, adopting full root credentials only after authentication, and then immediately replacing itself with the requested program. It never parses policy files, never keeps background helpers, and always clears the environment and search path before `execve`, drastically shrinking the attack surface compared to legacy privilege brokers.\n\n## Design goals\n\n- **Aggressively simple** – one binary, one command, zero configuration knobs.\n- **Aggressively safe** – refuses to run without setuid root, insists the caller re‑authenticates with their own password, drops supplemental groups, resets uid/gid, sets a predictable umask, and clears the environment.\n- **Predictable execution** – resolves the target command using a hard-coded, canonical root `PATH` and then `execve`s it directly so there is no long-lived privileged supervisor process.\n\n## How it works\n\n1. Verifies it is running with effective UID 0 (requires the binary to be owned by root and have the setuid bit).\n2. Prompts the invoking user (unless they are already root) for their UNIX password and verifies it against `/etc/shadow` using `crypt(3)`, allowing three attempts with a small backoff.\n3. Calls `setgroups(0, NULL)`, `setresgid(0,0,0)`, and `setresuid(0,0,0)` to fully adopt the root identity.\n4. Forces the process umask to `022` to avoid permissive files created by privileged programs.\n5. Resolves the requested command name against `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`. Relative or absolute paths are honored verbatim if supplied.\n6. Clears the process environment and replaces it with a minimal, known-safe set (`HOME=/root`, `PATH`, `TERM`, etc.).\n7. Performs an `execve`, so on success `elevate` is replaced by the requested program and inherits its exit status.\n\n## Installation\n\n1. Build a release binary:\n   ```bash\n   cargo build --release\n   ```\n2. Install it into a root-owned location (example uses `/usr/local/bin/elevate`):\n   ```bash\n   sudo install -o root -g root -m 0755 target/release/elevate /usr/local/bin/elevate\n   ```\n3. Enable setuid so unprivileged callers can adopt root:\n   ```bash\n   sudo chmod 4755 /usr/local/bin/elevate\n   ```\n\nIf any of those steps are skipped, `elevate` will refuse to run and print an explicit error.\n\n## Usage\n\n```\nelevate \u003ccommand\u003e [args...]\n```\n\n- Use `--` only if your command itself begins with `-`.\n- The program inherits no user environment. To pass custom variables, wrap your command with `env`, e.g. `elevate env VAR=value /usr/bin/env`.\n\nExample:\n\n```bash\nelevate apt-get update\n```\n\n## Security notes\n\n- `elevate` authorizes callers by re-checking their own UNIX password via `/etc/shadow`. Limit execution rights to appropriate users (e.g., via filesystem ACLs or group ownership) and ensure their accounts have strong passwords.\n- Passwords are read directly from the controlling TTY with echo disabled, never stored on disk, and zeroized in memory after verification.\n- Command resolution never consults the caller's `PATH`; only the hard-coded root-safe search path is used.\n- The environment is rebuilt from scratch to neutralize vectors such as `LD_PRELOAD` or `PYTHONPATH`. The only inherited piece is `TERM`, and even that is validated to simple ASCII before use.\n- Because the binary immediately `execve`s the target, there is no privileged helper lingering in memory to inspect or attack.\n\n## Optional tab completion\n\nShells treat `elevate` as a regular command, so to get `sudo`-style “complete the next word” behavior you can add a tiny wrapper completion:\n\n### Bash\n\nSave the following as `/etc/bash_completion.d/elevate` (system-wide) or `~/.local/share/bash-completion/completions/elevate`:\n\n```bash\n_elevate()\n{\n    _command_offset 1\n}\ncomplete -F _elevate elevate\n```\n\n### Zsh\n\nAdd to your `.zshrc`:\n\n```zsh\n_elevate() { _normal -p 1 }\ncompdef _elevate elevate\n```\n\nAfter reloading your shell, `elevate apt-g\u003cTab\u003e` will expand via the wrapped command’s completion rules just like `sudo`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvercingetorx%2Felevate","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvercingetorx%2Felevate","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvercingetorx%2Felevate/lists"}