Sample Header Ad - 728x90

Why would root need to run unrestricted commands as itself via doas?

2 votes
2 answers
1371 views
I've just come across doas, and while reading the [man page for its configuration](http://man.openbsd.org/doas.conf) I found this example: > The following example permits users in group wsrc to build ports; wheel to execute commands as any user while keeping the environment variables PS1 and SSH_AUTH_SOCK and unsetting ENV; permits tedu to run procmap as root without a password; **and additionally permits root to run unrestricted commands as itself**. # Non-exhaustive list of variables needed to # build release(8) and ports(7) permit nopass setenv { \ FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \ DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \ MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \ PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \ SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc permit setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel permit nopass tedu as root cmd /usr/sbin/procmap permit nopass keepenv root as root root is root, why would it need permissions? Note: I've tagged this with sudo as doas is a substitute/successor, so perhaps the reasoning or concepts will come from sudo or apply to both.
Asked by ian (169 rep)
Jul 21, 2016, 03:18 PM
Last activity: Feb 26, 2023, 05:48 PM