jperezduerto.info
Security in depth · Unit 22 · Lesson 20 of 44
A management group can carry broad power
Treat management-group membership as delegated authority, including existing sessions.
Helpful before thisLinux privilege escalation
After this lesson you can
- Identify why a group-directory change alone does not prove effective administrative access ended.
An ordinary account can hold an extraordinary management role.
Delegation through a service
A management group may let its members ask a powerful service to act for them. In conventional rootful Docker, access through the docker group grants root-level authority. Review the service’s powers, not just the user’s numeric identity.
Rootless deployment changes that model but still requires access review. Also separate a membership directory from running processes: supplementary group credentials are inherited by processes and do not automatically refresh when an administrator edits account records.
Supplied record: the design studio
The fictional studio uses a conventional rootful container manager. Soren’s temporary maintenance assignment ended yesterday; the owner now approves only reading published build logs.
Membership source: Soren removed from the management group at 10:00.
Process review at 10:05: an existing Soren process still carries that group.
Manager access model: conventional group-controlled local interface.
Session retirement and effective-access confirmation: not recorded.
Assume these records are current and no separate service authorization filter changes this model. The directory edit is real progress, but it does not prove Soren’s management access has ended. The record does not show misuse.
Define what retirement means
Write a closure checklist covering the membership source, active processes or sessions, and the manager’s accepted access. Assign the platform owner to approve the retirement plan and preserve the permitted log-reading workflow.
A replacement role should match that limited purpose instead of retaining broad management membership for convenience. Document the resulting access decision and confirmation time. Future memberships need their own owner and expiry, even if their accounts are labeled temporary.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which conclusion fits Soren’s access-retirement record?
Show the answer
Correct answer: Removal from the membership source is recorded, but effective management-access retirement is not yet demonstrated. The current process still carries the management group. Existing process credentials and the service access decision must be included in closure.
Try it
- WriteWrite a retirement checklist for Soren with three evidence rows: membership source, existing processes or sessions, and access accepted by the management service. Identify who confirms each result.