Annotation of src/usr.bin/doas/doas.conf.5, Revision 1.19
1.19 ! djm 1: .\" $OpenBSD: doas.conf.5,v 1.18 2016/01/02 08:34:47 jmc Exp $
1.1 tedu 2: .\"
3: .\"Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4: .\"
5: .\"Permission to use, copy, modify, and distribute this software for any
6: .\"purpose with or without fee is hereby granted, provided that the above
7: .\"copyright notice and this permission notice appear in all copies.
8: .\"
9: .\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: .\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: .\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: .\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: .\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: .\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: .\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.19 ! djm 16: .Dd $Mdocdate: January 2 2016 $
1.1 tedu 17: .Dt DOAS.CONF 5
18: .Os
19: .Sh NAME
20: .Nm doas.conf
21: .Nd doas configuration file
1.17 tedu 22: .Sh SYNOPSIS
23: .Nm /etc/doas.conf
1.1 tedu 24: .Sh DESCRIPTION
25: The
26: .Xr doas 1
27: utility executes commands as other users according to the rules
1.18 jmc 28: in the
29: .Nm
1.1 tedu 30: configuration file.
31: .Pp
32: The rules have the following format:
1.3 schwarze 33: .Bd -ragged -offset indent
34: .Ic permit Ns | Ns Ic deny
35: .Op Ar options
1.4 bentley 36: .Ar identity
1.3 schwarze 37: .Op Ic as Ar target
1.9 jmc 38: .Op Ic cmd Ar command Op Ic args ...
1.1 tedu 39: .Ed
40: .Pp
41: Rules consist of the following parts:
1.3 schwarze 42: .Bl -tag -width 11n
43: .It Ic permit Ns | Ns Ic deny
1.1 tedu 44: The action to be taken if this rule matches.
1.3 schwarze 45: .It Ar options
1.1 tedu 46: Options are:
1.3 schwarze 47: .Bl -tag -width keepenv
48: .It Ic nopass
1.1 tedu 49: The user is not required to enter a password.
1.3 schwarze 50: .It Ic keepenv
1.1 tedu 51: The user's environment is maintained.
1.5 benno 52: The default is to reset the environment, except for the variables
53: .Ev DISPLAY ,
54: .Ev HOME ,
55: .Ev LOGNAME ,
56: .Ev MAIL ,
57: .Ev PATH ,
58: .Ev TERM ,
59: .Ev USER
60: and
61: .Ev USERNAME .
1.12 jmc 62: .It Ic keepenv { Oo Ar variable ... Oc Ic }
63: In addition to the variables mentioned above, keep the space-separated
64: specified variables.
1.19 ! djm 65: .It Ic setenv { Oo Ar variable=value ... Oc Ic }
! 66: Sets one or more environment variables to the specified values.
! 67: If the first character of
! 68: .Ar value
! 69: is a
! 70: .Ql $
! 71: then the value to be set is taken from the existing enviornment
! 72: variable of the same name.
! 73: .Cm setenv
! 74: directives override environment variables copied via
! 75: .Cm keepenv .
1.1 tedu 76: .El
1.3 schwarze 77: .It Ar identity
1.1 tedu 78: The username to match.
1.12 jmc 79: Groups may be specified by prepending a colon
80: .Pq Sq \&: .
1.1 tedu 81: Numeric IDs are also accepted.
1.3 schwarze 82: .It Ic as Ar target
1.1 tedu 83: The target user the running user is allowed to run the command as.
1.13 tedu 84: The default is all users.
1.3 schwarze 85: .It Ic cmd Ar command
1.1 tedu 86: The command the user is allowed or denied to run.
87: The default is all commands.
88: Be advised that it's best to specify absolute paths.
1.16 tedu 89: If a cmd is specified, only a restricted
90: .Ev PATH
91: will be searched.
1.9 jmc 92: .It Ic args ...
1.8 zhuk 93: Arguments to command.
1.9 jmc 94: If specified, the command arguments provided by the user
95: need to match for the command to be successful.
1.8 zhuk 96: Specifying
97: .Ic args
98: alone means that command should be run without any arguments.
1.1 tedu 99: .El
100: .Pp
101: The last matching rule determines the action taken.
1.5 benno 102: .Pp
103: Comments can be put anywhere in the file using a hash mark
104: .Pq Sq # ,
105: and extend to the end of the current line.
1.10 zhuk 106: .Pp
107: The following quoting rules apply:
108: .Bl -dash
109: .It
110: The text between a pair of double quotes
111: .Pq Sq \&"
112: is taken as is.
113: .It
1.11 jmc 114: The backslash character
1.10 zhuk 115: .Pq Sq \e
1.11 jmc 116: escapes the next character, including new line characters, outside comments;
1.10 zhuk 117: as a result, comments may not be extended over multiple lines.
118: .It
1.11 jmc 119: If quotes or backslashes are used in a word,
120: it isn't considered a keyword.
1.10 zhuk 121: .El
1.1 tedu 122: .Sh EXAMPLES
1.5 benno 123: The following example permits users in group wsrc to build ports,
1.14 zhuk 124: wheel to execute commands as any user while keeping the environment
1.5 benno 125: variables
126: .Ev ENV ,
127: .Ev PS1 ,
128: and
129: .Ev SSH_AUTH_SOCK ,
1.15 reyk 130: permits tedu to run procmap as root without a password,
131: and additionally permits root to run unrestricted commands as itself.
1.1 tedu 132: .Bd -literal -offset indent
1.6 jmc 133: # Non-exhaustive list of variables needed to
1.5 benno 134: # build release(8) and ports(7)
135: permit nopass keepenv { \e
136: FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \e
137: DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \e
138: MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \e
139: PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \e
140: SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
141: permit nopass keepenv { ENV PS1 SSH_AUTH_SOCK } :wheel
1.14 zhuk 142: permit nopass tedu as root cmd /usr/sbin/procmap
1.15 reyk 143: permit nopass keepenv root as root
1.19 ! djm 144: permit nopass setenv { PS1=$DOAS_PS1 } :staff
1.1 tedu 145: .Ed
1.3 schwarze 146: .Sh SEE ALSO
147: .Xr doas 1
148: .Sh HISTORY
149: The
150: .Nm
151: configuration file first appeared in
152: .Ox 5.8 .
153: .Sh AUTHORS
154: .An Ted Unangst Aq Mt tedu@openbsd.org
![[BACK]](/icons/back.gif){kind=icon}
Return to doas.conf.5 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / doas