Doas – dedicated OpenBSD application subexecutor | Hacker News Reader

Doas – dedicated OpenBSD application subexecutor

flak.tedunangst.com

83 pointsosener41 comments

Open articleView on HN

And before there was "doas" there was setuidgid and envuidgid.

https://cr.yp.to/daemontools/setuidgid.html

https://cr.yp.to/daemontools/envuidgid.html

doas is much much nicer to type to, though.

I was initially skeptical but the superior simplicity and rigor won me over.

protip: nixos lets you use doas instead of (or in addition to) sudo. Since i run obsd serverside and nixos on the edge, this works great for me

programs.doas.enable = true;

I have no problem with doas on debian or arch through a package either.

Many sudo policies are often kind of horrible (even by default) and often facilitate privilege escalation, and then there was CVE-2019-14287 ( < 1.8.28 ) and CVE-2021-3156 ( < 1.9.5p2 ) which were plenty nasty. It's just way too huge for a setuid program, security tools shouldn't represent security holes as best as we can get away with it.

[1] https://www.thehacker.recipes/infra/privilege-escalation/uni...

precisely this.

Opendoas isn't immune to security problems, either, [1] but I try to have a policy of trying to use smaller programs and libraries of higher quality and sudo just isn't fitting the bill here. In production systems neither really needs to be installed/enabled (especially just to faciliate a local user to do whatever root can do), and su does just fine for administration tasks as long as you don't do something stupid like leave it logged in on tmux.

[1] https://nvd.nist.gov/vuln/detail/CVE-2019-15901

You might find this interesting: https://www.memorysafety.org/blog/sudo-first-stable-release/

Even better, add doas-sudo-shim to your system packages and disable sudo:

  security = {
    doas.enable = true;
    sudo.enable = false;
  };

  environment.systemPackages = [ pkgs.doas-sudo-shim ];

(2015)?

Ed: previously https://news.ycombinator.com/item?id=9914693

For those whose muscle memory is all confused now there's OpenDoas: https://github.com/Duncaen/OpenDoas

I don't understand the muscle memory relevance?

I can’t be the only one who started typing ‘doas’ on Linux/MacOS and ‘sudo’ on OpenBSD.

I just live dangerously and use `su -`

That's not living dangerously. Real men login as root (and cry).

Logins are for wimps. init=/bin/sh or bust.

Most use cases can be paved over with alias. "alias sudo=doas" or "alias doas=sudo"

OpenDOAS has actually had the OpenBSD-specific code removed (https://github.com/Duncaen/OpenDoas/commit/74449f015ff7a7230...), and replaces some of the doas mechanisms that rely upon OpenBSD to work with sudo-like flag files and suchlike.

There are, moreover, 2 ports of doas to other systems. OpenDOAS is one. Jesse Smith's https://github.com/slicer69/doas is the other. The latter retains the OpenBSD-specific code, and is the more portable of the two at the expense of only doing everything that the tool is capable of when actually built on OpenBSD.

https://xn--1xa.duncano.de/slicer69-doas.html

Off topic:

Love OpenBSD.

Wish so much Hammer2 comes to it because OpenBSD innovates so much but their file system is lacking.

There is an attempt to port DragonflyBDS Hammer2, and hope OpenBSD accepts it.

Last updated 3-days ago.

https://github.com/kusumi/openbsd_hammer2

What problems have you had with the file system? I have had softupdates turned on for as long as I can remember, and haven’t run into any issues.

Be aware, the project has turned off soft updates while they take a turn through filesystem land unlocking it. I have to admit given their reasoning I am not sure if it will come back. I always thought it was cool but I don't think it ever did all that much for performance or reliability.

Some context for them unfamiliar with soft-updates. it is an interesting system where writes are delayed and rearranged so they tend happen in-order, it was supposed to improve speed a bit(more writes in order) and resiliency(fewer states where the file system will corrupt on power outage) but it may have been too clever for it's own good. Nobody in the openbsd project wants to deal with it's complexity while they removes locks from the vfs layer.

Isn’t that just on -current?

Current has a habit of turning into release. And I am probably reading way too much into this, I have so special insight in the inner workings of the openbsd project. But if the people digging around in the filesystem code don't want it around while they work, I have no real hope for it to go back in when they are done.

is this actually going to wind up stopping Sudo bash or is this "if you use it right you don't need to" which is a euphemism for "yea but everyone does"

Anecdotal, but I've been using the doas in Arch's repository since switching to it. So far, I haven't come across anything that requires sudo instead of doas.

There are actually 2 Arch doases, note, one in the AUR and one in core. One is OpenDOAS, the other Smith doas.

Doubt it. The one thing doas is missing (from my POV) is caching the authorization. Sudo will allow you to cache the authorization on every(?) platform, but doas will only allow this on OpenBSD. If you're running "sudo bash" to avoid reentering your password a million times, doas (likely) won't help.

However if you're running "sudo bash", you should probably consider setting the root shell appropriately and just use "sudo -l".

OpenDoas has opt-in persistence via the --with-timestamp build flag. And on NixOS, for example, it's built with this flag by default.

Thanks for providing NixOS commentary. I’d was leery something in Nix would break, so I never tried.

No problem. FWIW I use doas over sudo on all 3 of my Nix hosts and I've only ever had one issue - VeraCrypt has a hardcoded shell-out to sudo, so I can't use it.

The proper fix would be VeraCrypt implementing polkit, but I just use cryptsetup's implementation.

This is actually an interesting case. Openbsd implemented timing out the connection by adding it to the tty[1]. this sort of shenanigan would never fly on linux, "what! improve an unrelated established system, I don't think so." So for a long time doas on linux was not able to timeout a session. At some later point the timeout code was re-implemented on linux using a different mechanism[2].

If your linux doas does not timeout, try updating it?

1. http://man.openbsd.org/tty.4#TIOCSETVERAUTH

2. https://github.com/Duncaen/OpenDoas/blob/master/timestamp.c

Well my use case was DragonFly and FreeBSD where there is a version of doas available, but not opendoas.

> "sudo -l"

ITYM "sudo -i" -l lists the programs your user may run as root/the-specified-user

The main thing missing is sudoedit equivalent. That replaces doas vi which is a security whole

Does doas have equivalents to the -i and -E flags in sudo? I use both of those frequently.

I switched from sudo to doas when setting up my new laptop ~ two years ago, took some time to get accustomed, but it is really much simpler..

For `sudo -i` you can just use `doas -s`. https://manpages.debian.org/bookworm/opendoas/doas.1.en.html

Keeping the environment via `sudo -E` is slightly trickier. If you need that for a fixed set of commands you can enable keeping the environment for those explicitly via the configuration file using the `keepenv` option. You can also set specific variables for specific commands,

https://manpages.debian.org/bookworm/opendoas/doas.conf.5.en...

But you would need to use a workaround if you want to keep the environment for a command without always adding that to the configuration, one way would to add a wrapper executable and add a permanent rule for that, e.g. something like the following should work:

  # reuse the `env` tool, but use an explicit symlink to have clear boundaries
  ln -s /bin/env /bin/keep-env
  
  # add rule for keep-env to doas cfg, replace USER with your user name, or prefix with : for a group
  echo 'permit persist keepenv USER cmd /bin/keep-env' | tee -a /etc/doas.conf
  
  # run command
  doas keep-env THE-ACTUAL-COMMAND

Disclaimer, not deeply tested and there might be even better options, but FWIW, this workaround is at least quite simple in principle.

Am I seeing the page correctly or someone get hacked?

"that's some bullshit"

I assume someone just doesn't like that OpenBSD does something other than sudo (which you can actually use either)?

I don't see that text anywhere on the page??

really wtf lol why the hell did that show in my browser then

It was probably some sort of database error page, (wild ass guess). the site got hugged, the backend took a little to long and a snarky error message popped out.

not too sure why this got me negative points. literally reporting what I was seeing and was too shocking not to confirm with everyone else.

Reply on news.ycombinator.com