All this configuration was thought to apply the Fail-safe default principle by Saltzer & Scroeder. This implies enforcing the most strict security options at the top-level of the configuration and overriding only at the lowest according to needs! So if you want to modify Build-time defaults, be very careful and understand the implications of your changes.
Before installing the tool, you might want to set default behavior. You’ll find in .cargo/config.toml :
These variables allows a customized compilation of the binary. With these variables you’ll be able to edit every behaviors, either hardcoded in the binary such as the root configuration file path, or the execution options when they aren’t defined at all in the policy.
Default processing stance for target system PATH variable management. Keep safe ignores relative paths, where keep_unsafe is allowing relative paths.
RAR_PATH_ADD_LIST
Colon-separated (:)
Explicit directory paths appended/inserted directly into the PATH.
RAR_PATH_REMOVE_LIST
Colon-separated (:)
Explicit directory paths to actively scrub out of the PATH.
RAR_WORKDIR_BEHAVIOR
String ("allowlist" | "blacklist")
Defines the basic behavioral model of the target directory ruleset.
RAR_WORKDIR_ADD_LIST
Comma-separated (,)
Allowed system directories where users are explicitly authorized to execute commands.
RAR_WORKDIR_REMOVE_LIST
Comma-separated (,)
Denylist of forbidden working directories where execution requests are rejected.
RAR_WORKDIR_FALLBACK
Optional File Path
Forces a static fallback working directory for the executed command if not defined. Warning! This will always set the working directory for every commands.
Be very careful with PATH management, "keep-unsafe" is insecure. And I strongly not reccommend it.
Working directory management is somewhat useful for some cases, such as allowing restricted commands only in a specific restricted directory. Of course that means that allowed commands shouldn't change internally the working directory. For example, if you set "/bin/ls" command, and setting fallback workdir to the "/tmp", then all "dosr ls" command will only show "/tmp" content, no matter where the user is located. Otherwise, if you set "/bin/ls .*" for the command, then the user still be able to retrieve folder contents everywhere on the system.
Controls whether explicit user authentication sequences must be requested.
RAR_BOUNDING
String ("strict" | "ignore")
Dictates whether to actively lock down or ignore the Linux capabilities “Bounding” set.
RAR_USER_CONSIDERED
String ("root" | "user")
Determines if UID 0 requests are treated like a regular user or preserve classic legacy root behavior.
RAR_UMASK
Octal / Decimal Integer
Default file creation mask applied directly to processes.
RAR_TIMEOUT_TYPE
String ("ppid" | "tty" | "uid")
The operating system context key used to track and anchor elevation timeouts.
RAR_TIMEOUT_DURATION
Duration "hh:mm:ss"
The temporal lifespan window allowed for a token before authorization validation expires.
RAR_TIMEOUT_MAX_USAGE
Integer (u64)
Absolute limits on how many times a given token context can be reused.
RAR_TIMEOUT_STORAGE
Folder Path
Filesystem path used by the timeout engine to persist execution timestamp tokens.
RAR_EXEC_INFO_DISPLAY
String ("hide" | "show")
Give the ability to users to know their allowed commands and configuration applied.
Showing to a user their policy can help attackers in their enumeration phase. A good policy knows what command a user is allowed to do in a such way that the user don't know that there is a strict policy applied.