How to Create Control Policies for Linux Devices?

Linux policies let you control what actions users can perform on Linux endpoints. You can create two types of Linux control policies:

• Command Control Policy — controls which users can run which commands, with or without SUDO privileges, on which Linux devices.
• File Management Policy — controls which users can Read, Write, or Execute specific files/file paths on Linux devices.

To create a Linux policy, navigate to Privileges >> Application Policies >> Add Policy, select Linux Policy, and follow the steps below.

1. Provide a name and description for the policy

Enter a name and description that clearly identify the purpose of the policy.

2. Choose the Application Elevation Preference

Under Application Elevation Preference, choose one of the following options to define how the policy governs access:

• Grant SUDO Privilege — allows the selected users to run the specified commands with SUDO privileges.
• Deny SUDO Privilege — blocks the selected users from running the specified commands with SUDO privileges.
• File Permissions — allows you to grant Read, Write, and/or Execute permissions on specific files or file paths on Linux endpoints, instead of controlling SUDO access to commands.

The steps that follow depend on which option you choose.

If you choose Grant SUDO Privilege or Deny SUDO Privilege

a. Select the commands. Search and select the commands/command groups for which the policy applies.

b. Specify the Linux devices. Choose the Linux devices on which the policy will be enforced.

c. Specify the Linux users/user groups. Associate the policy with specific users, or apply it to all users while excluding a few, as needed.

Note

You can associate the policy with specific users discovered on Linux endpoints, users/groups onboarded to Securden separately in the corresponding fields.

If you choose File Permissions

a. Select the Allowed Operations. Choose one or more of the following permissions to grant on the specified files:

• Read
• Write
• Execute

b. Specify the File Location. Enter the File Path of the file(s) the policy should apply to. If you want to add multiple files, use the + icon to add all the required file path to the same policy.

c. Associate the policy with Linux devices in Securden. Choose whether the policy applies to:

• All Devices – The policy will be associated with all Linux machines added to Securden.
• Specific Linux Devices – The policy will be associated with the specific Linux machines.

d. Associate the policy with Users/Groups in Securden. Choose one of the following:

• All users - The policy will be associated with all users on selected machines.
• Include specific users/groups - The policy will be associated with the selected users and groups on the selected machines.
• Exclude specific users/groups - The policy will be associated with all users except the selected users and groups on selected machines.

Once all preferences are selected, click Save.

Privilege Elevation Precedence

Application control policies (both command control and file management policies) can be created and associated with:

• Specific users
• All users
• All users except 'Excluded' ones

You can select the required command elevation mode to grant or deny SUDO privilege, or the required Read/Write/Execute file permissions, for the selected users.

If two different policies affect the same user, the policy in effect will be based on the following order of user precedence:

Specific Users >> All Users >> All Users except 'Excluded' ones

Note

By default, policies associated with all users will be prioritized over the policy created by excluding specific users. However, this order of priority between All users and Excluded users can be interchanged. Navigate to the configurations section to set the order of priority between All users and Excluded users.

If the two policies assigned have the same user precedence, the application control policy with granted SUDO privilege (or, for file management policies, the policy granting broader file permissions) will take precedence over the policy with denied SUDO privilege (or restricted permissions).

Example: User A has an application control policy (Policy 1) associated with them. Policy 1 allows them to elevate a specific application with SUDO privilege. A different control policy (Policy 2) denies User A the ability to elevate the application — since Policy 1 grants the privilege and Policy 2 denies it, and both share the same user precedence, Policy 1 (grant) takes precedence.