Why would root need to run unrestricted commands as itself via doas?
2
votes
2
answers
1371
views
I've just come across
doas
, and while reading the [man page for its configuration](http://man.openbsd.org/doas.conf) I found this example:
> The following example permits users in group wsrc to build ports; wheel to execute commands as any user while keeping the environment variables PS1 and SSH_AUTH_SOCK and unsetting ENV; permits tedu to run procmap as root without a password; **and additionally permits root to run unrestricted commands as itself**.
# Non-exhaustive list of variables needed to
# build release(8) and ports(7)
permit nopass setenv { \
FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \
DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \
MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \
PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \
SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
permit setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel
permit nopass tedu as root cmd /usr/sbin/procmap
permit nopass keepenv root as root
root is root, why would it need permissions?
Note: I've tagged this with sudo
as doas
is a substitute/successor, so perhaps the reasoning or concepts will come from sudo
or apply to both.
Asked by ian
(169 rep)
Jul 21, 2016, 03:18 PM
Last activity: Feb 26, 2023, 05:48 PM
Last activity: Feb 26, 2023, 05:48 PM