Annotation of src/usr.bin/doas/doas.conf.5, Revision 1.15
1.15 ! reyk 1: .\" $OpenBSD: doas.conf.5,v 1.14 2015/07/30 14:02:04 zhuk Exp $
1.1 tedu 2: .\"
3: .\"Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4: .\"
5: .\"Permission to use, copy, modify, and distribute this software for any
6: .\"purpose with or without fee is hereby granted, provided that the above
7: .\"copyright notice and this permission notice appear in all copies.
8: .\"
9: .\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: .\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: .\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: .\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: .\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: .\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: .\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.15 ! reyk 16: .Dd $Mdocdate: July 30 2015 $
1.1 tedu 17: .Dt DOAS.CONF 5
18: .Os
19: .Sh NAME
20: .Nm doas.conf
21: .Nd doas configuration file
22: .Sh DESCRIPTION
23: The
24: .Xr doas 1
25: utility executes commands as other users according to the rules
26: in the
27: .Nm
28: configuration file.
29: .Pp
30: The rules have the following format:
1.3 schwarze 31: .Bd -ragged -offset indent
32: .Ic permit Ns | Ns Ic deny
33: .Op Ar options
1.4 bentley 34: .Ar identity
1.3 schwarze 35: .Op Ic as Ar target
1.9 jmc 36: .Op Ic cmd Ar command Op Ic args ...
1.1 tedu 37: .Ed
38: .Pp
39: Rules consist of the following parts:
1.3 schwarze 40: .Bl -tag -width 11n
41: .It Ic permit Ns | Ns Ic deny
1.1 tedu 42: The action to be taken if this rule matches.
1.3 schwarze 43: .It Ar options
1.1 tedu 44: Options are:
1.3 schwarze 45: .Bl -tag -width keepenv
46: .It Ic nopass
1.1 tedu 47: The user is not required to enter a password.
1.3 schwarze 48: .It Ic keepenv
1.1 tedu 49: The user's environment is maintained.
1.5 benno 50: The default is to reset the environment, except for the variables
51: .Ev DISPLAY ,
52: .Ev HOME ,
53: .Ev LOGNAME ,
54: .Ev MAIL ,
55: .Ev PATH ,
56: .Ev TERM ,
57: .Ev USER
58: and
59: .Ev USERNAME .
1.12 jmc 60: .It Ic keepenv { Oo Ar variable ... Oc Ic }
61: In addition to the variables mentioned above, keep the space-separated
62: specified variables.
1.1 tedu 63: .El
1.3 schwarze 64: .It Ar identity
1.1 tedu 65: The username to match.
1.12 jmc 66: Groups may be specified by prepending a colon
67: .Pq Sq \&: .
1.1 tedu 68: Numeric IDs are also accepted.
1.3 schwarze 69: .It Ic as Ar target
1.1 tedu 70: The target user the running user is allowed to run the command as.
1.13 tedu 71: The default is all users.
1.3 schwarze 72: .It Ic cmd Ar command
1.1 tedu 73: The command the user is allowed or denied to run.
74: The default is all commands.
75: Be advised that it's best to specify absolute paths.
1.9 jmc 76: .It Ic args ...
1.8 zhuk 77: Arguments to command.
1.9 jmc 78: If specified, the command arguments provided by the user
79: need to match for the command to be successful.
1.8 zhuk 80: Specifying
81: .Ic args
82: alone means that command should be run without any arguments.
1.1 tedu 83: .El
84: .Pp
85: The last matching rule determines the action taken.
1.5 benno 86: .Pp
87: Comments can be put anywhere in the file using a hash mark
88: .Pq Sq # ,
89: and extend to the end of the current line.
1.10 zhuk 90: .Pp
91: The following quoting rules apply:
92: .Bl -dash
93: .It
94: The text between a pair of double quotes
95: .Pq Sq \&"
96: is taken as is.
97: .It
1.11 jmc 98: The backslash character
1.10 zhuk 99: .Pq Sq \e
1.11 jmc 100: escapes the next character, including new line characters, outside comments;
1.10 zhuk 101: as a result, comments may not be extended over multiple lines.
102: .It
1.11 jmc 103: If quotes or backslashes are used in a word,
104: it isn't considered a keyword.
1.10 zhuk 105: .El
1.1 tedu 106: .Sh EXAMPLES
1.5 benno 107: The following example permits users in group wsrc to build ports,
1.14 zhuk 108: wheel to execute commands as any user while keeping the environment
1.5 benno 109: variables
110: .Ev ENV ,
111: .Ev PS1 ,
112: and
113: .Ev SSH_AUTH_SOCK ,
1.15 ! reyk 114: permits tedu to run procmap as root without a password,
! 115: and additionally permits root to run unrestricted commands as itself.
1.1 tedu 116: .Bd -literal -offset indent
1.6 jmc 117: # Non-exhaustive list of variables needed to
1.5 benno 118: # build release(8) and ports(7)
119: permit nopass keepenv { \e
120: FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \e
121: DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \e
122: MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \e
123: PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \e
124: SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
125: permit nopass keepenv { ENV PS1 SSH_AUTH_SOCK } :wheel
1.14 zhuk 126: permit nopass tedu as root cmd /usr/sbin/procmap
1.15 ! reyk 127: permit nopass keepenv root as root
1.1 tedu 128: .Ed
1.3 schwarze 129: .Sh SEE ALSO
130: .Xr doas 1
131: .Sh HISTORY
132: The
133: .Nm
134: configuration file first appeared in
135: .Ox 5.8 .
136: .Sh AUTHORS
137: .An Ted Unangst Aq Mt tedu@openbsd.org