doas - ArchWiki

Jump to content

# doas

From ArchWiki

Related articles

- List of applications/Security#Privilege elevation
- run0
- sudo
- Users and groups

OpenDoas is a portable version of OpenBSD's doas command, known for being substantially smaller in size compared to sudo. Like sudo, doas is used to assume the identity of another user on the system.

## Installation

Install the opendoas package.

## Usage

To begin using doas as a non-privileged user, it must be properly configured. See #Configuration.

To use doas, simply prefix a command and its arguments with `doas` and a space:

    $ doas cmd

For example, to use pacman:

    $ doas pacman -Syu

To get to an interactive shell as an other user (omitting `-u user` will default to root):

    $ doas -su user

Logging in as an other user is needed for some commands, see Sudo#Login shell.

For more information, see doas(1).

## Configuration

After installing OpenDoas, it will be attached with PAM, but no default configuration or examples are included.

To allow members of group wheel to run commands as other users, create a configuration file with the following content:

    /etc/doas.conf

    permit setenv {PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin} :wheel

Note

- The configuration file must end with a newline.
- The `setenv` option works around an issue arising from OpenDoas's BSD origin where additional system packages are stored under `/usr/local/bin`. In Linux `/usr/local/bin` is generally used to override executables so it comes before `/usr/bin` which contains executables from packages.

The owner and group for `/etc/doas.conf` should both be `root`, file permissions should be set to `0400`:

    # chown -c root:root /etc/doas.conf
    # chmod -c 0400 /etc/doas.conf

To check `/etc/doas.conf` for syntax errors, run:

    # if doas -C /etc/doas.conf; then echo "config ok"; else echo "config error"; fi

Warning It is imperative that `/etc/doas.conf` is free of syntax errors!

To allow members of the `plugdev` group to run smartctl without password as Root user:

    /etc/doas.conf

    permit nopass :plugdev as root cmd /usr/bin/smartctl

The general syntax form of `/etc/doas.conf` is:

    permit|deny [options] identity [as target] [cmd command [args ...]]

The last matching rule determines the action taken, so rules must be ordered accordingly.

For more details please read doas.conf(5).

## Tips and tricks

### doas persist feature

doas provides a persist feature: after the user successfully authenticates, they will not be prompted for a password again for 5 minutes. It is disabled by default, enable it with the `persist` option:

    /etc/doas.conf

    permit persist setenv {PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin} :wheel

Executing `doas -L` clears a persisted authentication prior to its automatic timeout.

Note The persist feature is disabled by default, because it is potentially dangerous. In the original doas, a kernel API is used to set and clear timeouts. This API is OpenBSD specific and no similar API is available on other operating systems. As a workaround, the persist feature is implemented using timestamp files similar to sudo.

### Getting rid of sudo

Once you want to replace and remove the sudo package completely, install the doas-sudo-shimAUR package. It provides sudo compatible options for a smooth transition to doas. In addition, you can add to your shell#Configuration files:

    alias sudoedit='doas rnano'

Note

By default, sudo preserves some environment variables which doas does not, most notably `XAUTHORITY`, `LANG`, and `LC_ALL`. This means you will not be able to start graphical applications under X nor to access the user's locale without further configuration. For instance, to allow members of the wheel group to run graphical applications and to access the user's locale using the `setenv` option:

    /etc/doas.conf

    permit setenv { XAUTHORITY LANG LC_ALL } :wheel

doas-sudo-shimAUR sets `SUDO_UID`, `SUDO_GID`, and `SUDO_USER` before invoking doas, for compatibility with tools that read these variables (set unconditionally by real sudo) to identify the original invoking user, e.g. to locate their D-Bus session for desktop notifications. As with `XAUTHORITY`, `LANG`, and `LC_ALL` above, doas will strip these unless explicitly allowed via `setenv` or `keepenv`:

    /etc/doas.conf

    permit setenv { SUDO_UID SUDO_GID SUDO_USER } :wheel

Remember that these variables are only set by the shim itself, so this only takes effect when invoking commands via the `sudo` shim. Calling `doas` directly does not populate them, since doas has no built-in equivalent to sudo's automatic `SUDO_*` exports.

See the doas-sudo-shim ENVIRONMENT documentation for details.

Also keep in mind that the shim does not support all options that sudo does (in particular, `-k` is approximated); this may cause some applications to break.

- makepkg should be configured to use doas directly[1]:

      PACMAN_AUTH=(doas -n)

- `-E`/`--preserve-env` is not supported by the shim, since it has no direct doas equivalent. Scripts or commands relying on `sudo -E` to forward the calling environment will not behave as expected under the shim; use the `setenv`/`keepenv` options in `doas.conf` to explicitly allow the specific variables needed instead.

### Bash tab completion

By default Bash will only tab complete files and directories within the current or referenced directory. To tell Bash to complete arguments as if they were separate commands (also leveraging the tab completion settings of other commands) the following can be added to either the users `.bashrc`, or the global `/etc/bash.bashrc`:

    ~/.bashrc

    complete -cf doas

If bash-completion is installed, the following can be used instead to allow for additional completion of the target command:

    ~/.bashrc

    complete -F _command doas

Categories:

- Security
- Commands
- OpenBSD

doas
Add topic