Return to doas.conf.5 CVS log

Up to [local] / src / usr.bin / doas

Annotation of src/usr.bin/doas/doas.conf.5, Revision 1.13

1.13    ! tedu        1: .\" $OpenBSD: doas.conf.5,v 1.12 2015/07/27 17:57:06 jmc Exp $
1.1       tedu        2: .\"
                      3: .\"Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
                      4: .\"
                      5: .\"Permission to use, copy, modify, and distribute this software for any
                      6: .\"purpose with or without fee is hereby granted, provided that the above
                      7: .\"copyright notice and this permission notice appear in all copies.
                      8: .\"
                      9: .\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                     10: .\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     11: .\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     12: .\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     13: .\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     14: .\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     15: .\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.13    ! tedu       16: .Dd $Mdocdate: July 27 2015 $
1.1       tedu       17: .Dt DOAS.CONF 5
                     18: .Os
                     19: .Sh NAME
                     20: .Nm doas.conf
                     21: .Nd doas configuration file
                     22: .Sh DESCRIPTION
                     23: The
                     24: .Xr doas 1
                     25: utility executes commands as other users according to the rules
                     26: in the
                     27: .Nm
                     28: configuration file.
                     29: .Pp
                     30: The rules have the following format:
1.3       schwarze   31: .Bd -ragged -offset indent
                     32: .Ic permit Ns | Ns Ic deny
                     33: .Op Ar options
1.4       bentley    34: .Ar identity
1.3       schwarze   35: .Op Ic as Ar target
1.9       jmc        36: .Op Ic cmd Ar command Op Ic args ...
1.1       tedu       37: .Ed
                     38: .Pp
                     39: Rules consist of the following parts:
1.3       schwarze   40: .Bl -tag -width 11n
                     41: .It Ic permit Ns | Ns Ic deny
1.1       tedu       42: The action to be taken if this rule matches.
1.3       schwarze   43: .It Ar options
1.1       tedu       44: Options are:
1.3       schwarze   45: .Bl -tag -width keepenv
                     46: .It Ic nopass
1.1       tedu       47: The user is not required to enter a password.
1.3       schwarze   48: .It Ic keepenv
1.1       tedu       49: The user's environment is maintained.
1.5       benno      50: The default is to reset the environment, except for the variables
                     51: .Ev DISPLAY ,
                     52: .Ev HOME ,
                     53: .Ev LOGNAME ,
                     54: .Ev MAIL ,
                     55: .Ev PATH ,
                     56: .Ev TERM ,
                     57: .Ev USER
                     58: and
                     59: .Ev USERNAME .
1.12      jmc        60: .It Ic keepenv { Oo Ar variable ... Oc Ic }
                     61: In addition to the variables mentioned above, keep the space-separated
                     62: specified variables.
1.1       tedu       63: .El
1.3       schwarze   64: .It Ar identity
1.1       tedu       65: The username to match.
1.12      jmc        66: Groups may be specified by prepending a colon
                     67: .Pq Sq \&: .
1.1       tedu       68: Numeric IDs are also accepted.
1.3       schwarze   69: .It Ic as Ar target
1.1       tedu       70: The target user the running user is allowed to run the command as.
1.13    ! tedu       71: The default is all users.
1.3       schwarze   72: .It Ic cmd Ar command
1.1       tedu       73: The command the user is allowed or denied to run.
                     74: The default is all commands.
                     75: Be advised that it's best to specify absolute paths.
1.9       jmc        76: .It Ic args ...
1.8       zhuk       77: Arguments to command.
1.9       jmc        78: If specified, the command arguments provided by the user
                     79: need to match for the command to be successful.
1.8       zhuk       80: Specifying
                     81: .Ic args
                     82: alone means that command should be run without any arguments.
1.1       tedu       83: .El
                     84: .Pp
                     85: The last matching rule determines the action taken.
1.5       benno      86: .Pp
                     87: Comments can be put anywhere in the file using a hash mark
                     88: .Pq Sq # ,
                     89: and extend to the end of the current line.
1.10      zhuk       90: .Pp
                     91: The following quoting rules apply:
                     92: .Bl -dash
                     93: .It
                     94: The text between a pair of double quotes
                     95: .Pq Sq \&"
                     96: is taken as is.
                     97: .It
1.11      jmc        98: The backslash character
1.10      zhuk       99: .Pq Sq \e
1.11      jmc       100: escapes the next character, including new line characters, outside comments;
1.10      zhuk      101: as a result, comments may not be extended over multiple lines.
                    102: .It
1.11      jmc       103: If quotes or backslashes are used in a word,
                    104: it isn't considered a keyword.
1.10      zhuk      105: .El
1.1       tedu      106: .Sh EXAMPLES
1.5       benno     107: The following example permits users in group wsrc to build ports,
                    108: wheel to execute commands as root while keeping the environment
                    109: variables
                    110: .Ev ENV ,
                    111: .Ev PS1 ,
                    112: and
                    113: .Ev SSH_AUTH_SOCK ,
1.1       tedu      114: and additionally permits tedu to run procmap as root without a password.
                    115: .Bd -literal -offset indent
1.6       jmc       116: # Non-exhaustive list of variables needed to
1.5       benno     117: # build release(8) and ports(7)
                    118: permit nopass keepenv { \e
                    119:         FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \e
                    120:         DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \e
                    121:         MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \e
                    122:         PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \e
                    123:         SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
                    124: permit nopass keepenv { ENV PS1 SSH_AUTH_SOCK } :wheel
1.1       tedu      125: permit nopass tedu cmd /usr/sbin/procmap
                    126: .Ed
1.3       schwarze  127: .Sh SEE ALSO
                    128: .Xr doas 1
                    129: .Sh HISTORY
                    130: The
                    131: .Nm
                    132: configuration file first appeared in
                    133: .Ox 5.8 .
                    134: .Sh AUTHORS
                    135: .An Ted Unangst Aq Mt tedu@openbsd.org