71 lines
No EOL
5.3 KiB
Markdown
71 lines
No EOL
5.3 KiB
Markdown
---
|
||
obj: application
|
||
repo: https://github.com/Duncaen/OpenDoas
|
||
wiki: https://en.wikipedia.org/wiki/Doas
|
||
arch-wiki: https://wiki.archlinux.org/title/Doas
|
||
---
|
||
|
||
# doas
|
||
doas is a program to execute commands as another user. The system administrator can configure it to give specified users privileges to execute specified commands. It is free and open-source under the ISC license and available in Unix and Unix-like operating systems ([FreeBSD](../../../bsd/FreeBSD.md), [OpenBSD](../../../bsd/OpenBSD.md), [Linux](../../../linux/Linux.md)).
|
||
|
||
## Usage
|
||
To use doas, simply prefix a command and its arguments with doas and a space:
|
||
```shell
|
||
$ doas cmd
|
||
```
|
||
|
||
To get to an interactive shell with root prompt:
|
||
```shell
|
||
$ doas -s
|
||
```
|
||
|
||
### Options
|
||
| Option | Description |
|
||
| --------- | ------------------------------------------------- |
|
||
| `-s` | Execute the shell from `$SHELL` or `/etc/passwd`. |
|
||
| `-u user` | Execute the command as user. The default is root. |
|
||
|
||
## Configuration
|
||
The configuration for doas is stored at `/etc/doas.conf`.
|
||
|
||
The config file consist of rules with the following format:
|
||
`permit|deny [options] identity [as target] [cmd command [args ...]]`
|
||
|
||
Rules consist of the following parts:
|
||
- `permit|deny`: The action to be taken if this rule matches.
|
||
|
||
Options:
|
||
|
||
| Option | Description |
|
||
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||
| `nopass` | The user is not required to enter a password. |
|
||
| `nolog` | Do not log successful command execution to syslogd |
|
||
| `persist` | After the user successfully authenticates, do not ask for a password again for some time. |
|
||
| `keepenv` | Environment variables other than those listed in doas are retained when creating the environment for the new process. |
|
||
| `setenv {var=value}` | Keep or set the space-separated specified variables. Variables may also be removed with a leading ‘-’ or set using the latter syntax. If the first character of value is a ‘`$`’ then the value to be set is taken from the existing environment variable of the indicated name. This option is processed after the default environment has been created. |
|
||
|
||
|
||
- `identity`: The username to match. Groups may be specified by prepending a colon (‘:’). Numeric IDs are also accepted.
|
||
|
||
- `as`: The target user the running user is allowed to run the command as. The default is all users.
|
||
|
||
- `cmd`: The command the user is allowed or denied to run. The default is all commands. Be advised that it is best to specify absolute paths. If a relative path is specified, only a restricted `PATH` will be searched.
|
||
|
||
- `args`: Arguments to command. The command arguments provided by the user need to match those specified. The keyword `args` alone means that command must be run without any arguments.
|
||
|
||
The last matching rule determines the action taken. If no rule matches, the action is denied.
|
||
|
||
Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line.
|
||
|
||
The following quoting rules apply:
|
||
- The text between a pair of double quotes (‘"’) is taken as is.
|
||
- The backslash character (‘\’) escapes the next character, including new line characters, outside comments; as a result, comments may not be extended over multiple lines.
|
||
- If quotes or backslashes are used in a word, it is not considered a keyword.
|
||
|
||
### Examples
|
||
```
|
||
permit persist setenv { PKG_CACHE PKG_PATH } aja cmd pkg_add
|
||
permit setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel
|
||
permit nopass tedu as root cmd /usr/sbin/procmap
|
||
permit nopass keepenv setenv { PATH } root as root
|
||
``` |