6 ms·
Doas – dedicated OpenBSD application subexecutor
- irdc 3y agoFor those whose muscle memory is all confused now there's OpenDoas: https://github.com/Duncaen/OpenDoas https://github.com/Duncaen/OpenDoas
- CameronNemo 3y agoI don't understand the muscle memory relevance?
- chungy 3y agoMost use cases can be paved over with alias. "alias sudo=doas" or "alias doas=sudo"
- JdeBP 3y agoOpenDOAS has actually had the OpenBSD-specific code removed (https://github.com/Duncaen/OpenDoas/commit/74449f015ff7a72300be5a27680d2c70af309328 https://github.com/Duncaen/OpenDoas/commit/74449f015ff7a7230...), and replaces some of the doas mechanisms that rely upon OpenBSD to work with sudo-like flag files and suchlike. There are, moreover, 2 ports of doas to other systems. OpenDOAS is one. Jesse Smith's https://github.com/slicer69/doas https://github.com/slicer69/doas is the other. The latter retains the OpenBSD-specific code, and is the more portable of the two at the expense of only doing everything that the tool is capable of when actually built on OpenBSD.
- 5e92cb50239222b 3y agohttps://π.duncano.de/slicer69-doas.html https://xn--1xa.duncano.de/slicer69-doas.html
- 1vuio0pswjnm7 3y agoAnd before there was "doas" there was setuidgid and envuidgid. https://cr.yp.to/daemontools/setuidgid.html https://cr.yp.to/daemontools/setuidgid.html https://cr.yp.to/daemontools/envuidgid.html https://cr.yp.to/daemontools/envuidgid.html
- lemper 3y agodoas is much much nicer to type to, though.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- lacoolj 3y agoAm I seeing the page correctly or someone get hacked? "that's some bullshit" I assume someone just doesn't like that OpenBSD does something other than sudo (which you can actually use either)?
- 1attice 3y agoI was initially skeptical but the superior simplicity and rigor won me over. protip: nixos lets you use doas instead of (or in addition to) sudo. Since i run obsd serverside and nixos on the edge, this works great for me programs.doas.enable = true;
- jamal-kumar 3y agoI have no problem with doas on debian or arch through a package either. Many sudo policies are often kind of horrible (even by default) and often facilitate privilege escalation, and then there was CVE-2019-14287 ( < 1.8.28 ) and CVE-2021-3156 ( < 1.9.5p2 ) which were plenty nasty. It's just way too huge for a setuid program, security tools shouldn't represent security holes as best as we can get away with it. [1] https://www.thehacker.recipes/infra/privilege-escalation/unix/sudo https://www.thehacker.recipes/infra/privilege-escalation/uni...
- 1attice 3y agoprecisely this.
- jamal-kumar 3y agoOpendoas isn't immune to security problems, either, [1] but I try to have a policy of trying to use smaller programs and libraries of higher quality and sudo just isn't fitting the bill here. In production systems neither really needs to be installed/enabled (especially just to faciliate a local user to do whatever root can do), and su does just fine for administration tasks as long as you don't do something stupid like leave it logged in on tmux. [1] https://nvd.nist.gov/vuln/detail/CVE-2019-15901 https://nvd.nist.gov/vuln/detail/CVE-2019-15901
- akyuu 3y agoYou might find this interesting: https://www.memorysafety.org/blog/sudo-first-stable-release/ https://www.memorysafety.org/blog/sudo-first-stable-release/
- sdeer 3y ago
- ggm 3y agois this actually going to wind up stopping Sudo bash or is this "if you use it right you don't need to" which is a euphemism for "yea but everyone does"
- 11Spades 3y agoAnecdotal, but I've been using the doas in Arch's repository since switching to it. So far, I haven't come across anything that requires sudo instead of doas.
- JdeBP 3y agoThere are actually 2 Arch doases, note, one in the AUR and one in core. One is OpenDOAS, the other Smith doas.
- inferiorhuman 3y agoDoubt it. The one thing doas is missing (from my POV) is caching the authorization. Sudo will allow you to cache the authorization on every(?) platform, but doas will only allow this on OpenBSD. If you're running "sudo bash" to avoid reentering your password a million times, doas (likely) won't help. However if you're running "sudo bash", you should probably consider setting the root shell appropriately and just use "sudo -l".
- BrotherBisquick 3y agoDoes doas have equivalents to the -i and -E flags in sudo? I use both of those frequently.
- tlamponi 3y agoI switched from sudo to doas when setting up my new laptop ~ two years ago, took some time to get accustomed, but it is really much simpler.. For `sudo -i` you can just use `doas -s`. https://manpages.debian.org/bookworm/opendoas/doas.1.en.html https://manpages.debian.org/bookworm/opendoas/doas.1.en.html Keeping the environment via `sudo -E` is slightly trickier. If you need that for a fixed set of commands you can enable keeping the environment for those explicitly via the configuration file using the `keepenv` option. You can also set specific variables for specific commands, https://manpages.debian.org/bookworm/opendoas/doas.conf.5.en.html https://manpages.debian.org/bookworm/opendoas/doas.conf.5.en... But you would need to use a workaround if you want to keep the environment for a command without always adding that to the configuration, one way would to add a wrapper executable and add a permanent rule for that, e.g. something like the following should work: # reuse the `env` tool, but use an explicit symlink to have clear boundaries ln -s /bin/env /bin/keep-env # add rule for keep-env to doas cfg, replace USER with your user name, or prefix with : for a group echo 'permit persist keepenv USER cmd /bin/keep-env' | tee -a /etc/doas.conf # run command doas keep-env THE-ACTUAL-COMMAND Disclaimer, not deeply tested and there might be even better options, but FWIW, this workaround is at least quite simple in principle.
- e12e 3y ago(2015)? Ed: previously https://news.ycombinator.com/item?id=9914693 https://news.ycombinator.com/item?id=9914693
- tiffanyh 3y agoOff topic: Love OpenBSD. Wish so much Hammer2 comes to it because OpenBSD innovates so much but their file system is lacking. There is an attempt to port DragonflyBDS Hammer2, and hope OpenBSD accepts it. Last updated 3-days ago. https://github.com/kusumi/openbsd_hammer2 https://github.com/kusumi/openbsd_hammer2
- pnpnp 3y agoWhat problems have you had with the file system? I have had softupdates turned on for as long as I can remember, and haven’t run into any issues.
- somat 3y agoBe aware, the project has turned off soft updates while they take a turn through filesystem land unlocking it. I have to admit given their reasoning I am not sure if it will come back. I always thought it was cool but I don't think it ever did all that much for performance or reliability. Some context for them unfamiliar with soft-updates. it is an interesting system where writes are delayed and rearranged so they tend happen in-order, it was supposed to improve speed a bit(more writes in order) and resiliency(fewer states where the file system will corrupt on power outage) but it may have been too clever for it's own good. Nobody in the openbsd project wants to deal with it's complexity while they removes locks from the vfs layer.
- pnpnp 3y agoIsn’t that just on -current?
- somat 3y agoCurrent has a habit of turning into release. And I am probably reading way too much into this, I have so special insight in the inner workings of the openbsd project. But if the people digging around in the filesystem code don't want it around while they work, I have no real hope for it to go back in when they are done.