transition sudo to doas - shell scripts

ua4000 · 2021-09-13 19:02:54

I'm struggling at two points regarding doas in shell scripting:

a) sudo -l prints the allowed commands for the current user --> easy to check in scripts.
How to do this in doas ?
"doas -C /etc/doas.conf command" could be a way (see manpage), to check for "permit" and "nopass" in the output, but only works if the file doas.conf is readable by the user - which is not the case at recommended 0400 permissions...

b) In doas.conf and sudoers config file you use of course absolute path names, e.g. to configure smartctl usage without password.
But in usage sudo vs. doas there is a noticeable difference:

sudo smartctl		--> works without password
doas smartctl		--> does not work without password
doas /usr/bin/smartctl	--> works without password

So I had to modify all scrips to use absolute path names in the doas commands ?

Thanks!

seth · 2021-09-13 20:58:09

/usr/local/bin/doas

#!/bin/sh
/usr/bin/doas "$(type -p "$1")" "${@:2}"

You could allow yourself to "doas doas -C" (or put "doas -C | filter_stuff" into as script and doas that to limit the access)

ua4000 · 2021-09-14 14:32:22

Thanks,
instead of "type -p" I think "command -v" is also fine, (or which, but this is discouraged ?)

Yes, for "doas -C" another line in /etc/doas.conf... but here we must be careful not to open a backdoor... pitfalls no 1. in doas :-)

seth · 2021-09-14 14:47:10

https://unix.stackexchange.com/question … 5250#85250
https://mywiki.wooledge.org/BashFAQ/081

"command -v" is fine (but more letters to type ;-)

Maybe file bugs/feature requests against doas - matching the canonical path and printing permissions is better suited there than in a gazillion broken user scripts.

Arch Linux

#1 2021-09-13 19:02:54

transition sudo to doas - shell scripts

#2 2021-09-13 20:58:09

Re: transition sudo to doas - shell scripts

#3 2021-09-14 14:32:22

Re: transition sudo to doas - shell scripts

#4 2021-09-14 14:47:10

Re: transition sudo to doas - shell scripts

Board footer