RBAC
also: Role-Based Access Control
Role-Based Access Control (RBAC) is a security model that restricts system access based on a user's assigned role rather than individual permissions, simplifying management of who can do what.
RBAC organizes permissions into predefined roles, and users are assigned to roles that grant them specific capabilities. For example, a 'database_admin' role might have permissions to create, modify, and delete databases, while a 'viewer' role can only read data. This is more manageable than assigning individual permissions to each user.
In Linux, RBAC can be implemented through mechanisms like sudo with role-based configuration, SELinux (Security-Enhanced Linux) policies, or AppArmor profiles. For instance, you might define a role that allows certain users to restart services without full root access.
RBAC scales better than discretionary access control (DAC) in environments with many users, because administrators manage permissions at the role level rather than per-user. Changes to a role's permissions automatically apply to all users assigned that role.