Misplaced Pages

doas

Original author(s)	Ted Unangst
Developer(s)	OpenBSD Project
Initial release	18 October 2015; 9 years ago (2015-10-18)
Stable release	1.99  / 15 February 2024; 11 months ago (15 February 2024)
Repository	cvsweb.openbsd.org/src/usr.bin/doas/
Written in	C
Type	Security software
License	ISC license
Website	https://man.openbsd.org/doas

doas (“dedicated openbsd application subexecutor”) is a program to execute commands as another user. The system administrator can configure it to give specified users privileges to execute specified commands. It is free and open-source under the ISC license and available in Unix and Unix-like operating systems.

doas was developed by Ted Unangst for OpenBSD as a simpler and safer sudo replacement. Unangst himself had issues with the default sudo config, which was his motivation to develop doas. doas was released with OpenBSD 5.8 in October 2015 replacing sudo. However, OpenBSD still provides sudo as a package.

Configuration

Definition of privileges should be written in the configuration file, /etc/doas.conf. The syntax used in the configuration file is inspired by the packet filter configuration file.

Examples

Allow user1 to execute procmap as root without password:

permit nopass user1 as root cmd /usr/sbin/procmap

Allow members of the wheel group to run any command as root:

permit :wheel as root

Simpler version (only works if default user is root, which it is after install):

permit :wheel

To allow members of wheel group to run any command (default as root) and remember that they entered the password:

permit persist :wheel

Ports and availability

Jesse Smith’s port of doas is packaged for DragonFlyBSD, FreeBSD, and NetBSD. According to the author, it also works on illumos and macOS.

OpenDoas, a Linux port, is packaged for Debian, Alpine, Arch, CRUX, Fedora, Gentoo, GNU Guix, Hyperbola, Manjaro, Parabola, NixOS, Ubuntu, and Void Linux. Starting with Alpine Linux v3.16 release, OpenDoas became the suggested replacement for sudo, which got its security maintenance time reduced within the distribution.

See also

• sudo
• runas

References

1. ^ "OpenBSD 5.8". www.openbsd.org. Archived from the original on 2021-05-17. Retrieved 2020-05-06.
2. "src/usr.bin/doas/doas.c - view - 1.98". 2022-12-22. Retrieved 2023-07-22.
3. ^ "doas - dedicated openbsd application subexecutor". flak.tedunangst.com. Retrieved 2022-01-01.
4. "Archived copy". Archived from the original on 2021-03-03. Retrieved 2021-09-29.{{cite web}}: CS1 maint: archived copy as title (link)
5. doas(1) – OpenBSD General Commands Manual
6. Yegulalp, Serdar (2016-07-25). "OpenBSD 6.0 tightens security by losing Linux compatibility". InfoWorld. Archived from the original on 2021-07-25. Retrieved 2020-05-06.
7. Millman, Rene (18 October 2019). "Linux Sudo bug could allow hackers root access". SC Media UK. Archived from the original on 2021-09-29. Retrieved 2020-05-06.
8. "Privileges | OpenBSD Handbook". www.openbsdhandbook.com. Archived from the original on 2021-03-03. Retrieved 2020-05-06.
9. "Slicer69 (Jesse Smith) · GitHub". GitHub. Archived from the original on 2021-08-31. Retrieved 2020-05-06.
10. "DPorts/Security/Doas at master · DragonFlyBSD/DPorts · GitHub". GitHub. Archived from the original on 2021-03-03. Retrieved 2020-08-24.
11. "[ports] Log of /Head/Security/Doas/PKG-descr". Archived from the original on 2021-09-29. Retrieved 2020-08-24.
12. "The NetBSD Packages Collection: security/doas". ftp.netbsd.org. Archived from the original on 2021-09-29. Retrieved 2020-05-06.
13. Smith, Jesse. "doas". GitHub. Archived from the original on 2021-04-27. Retrieved 2020-08-24.
14. "opendoas". repology.org. Archived from the original on 2021-03-03. Retrieved 2020-08-24.
15. "Alpine 3.16.0 released". alpinelinux.org. Retrieved 2023-06-10.

• Computer security software
• Unix software