===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/doas/parse.y,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- src/usr.bin/doas/parse.y	2016/06/07 16:49:23	1.18
+++ src/usr.bin/doas/parse.y	2016/06/27 15:41:17	1.19
@@ -1,4 +1,4 @@
-/* $OpenBSD: parse.y,v 1.18 2016/06/07 16:49:23 tedu Exp $ */
+/* $OpenBSD: parse.y,v 1.19 2016/06/27 15:41:17 tedu Exp $ */
 /*
  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
  *
@@ -48,6 +48,7 @@
 struct rule **rules;
 int nrules, maxrules;
 int parse_errors = 0;
+int obsolete_warned = 0;
 
 void yyerror(const char *, ...);
 int yylex(void);
@@ -56,7 +57,7 @@
 %}
 
 %token TPERMIT TDENY TAS TCMD TARGS
-%token TNOPASS TKEEPENV
+%token TNOPASS TKEEPENV TSETENV
 %token TSTRING
 
 %%
@@ -97,15 +98,19 @@
 			$$.envlist = $2.envlist;
 		} | TDENY {
 			$$.action = DENY;
+			$$.options = 0;
+			$$.envlist = NULL;
 		} ;
 
-options:	/* none */
-		| options option {
+options:	/* none */ {
+			$$.options = 0;
+			$$.envlist = NULL;
+		} | options option {
 			$$.options = $1.options | $2.options;
 			$$.envlist = $1.envlist;
 			if ($2.envlist) {
 				if ($$.envlist) {
-					yyerror("can't have two keepenv sections");
+					yyerror("can't have two setenv sections");
 					YYERROR;
 				} else
 					$$.envlist = $2.envlist;
@@ -113,11 +118,20 @@
 		} ;
 option:		TNOPASS {
 			$$.options = NOPASS;
+			$$.envlist = NULL;
 		} | TKEEPENV {
 			$$.options = KEEPENV;
+			$$.envlist = NULL;
 		} | TKEEPENV '{' envlist '}' {
-			$$.options = KEEPENV;
+			$$.options = 0;
+			if (!obsolete_warned) {
+				warnx("keepenv with list is obsolete");
+				obsolete_warned = 1;
+			}
 			$$.envlist = $3.envlist;
+		} | TSETENV '{' envlist '}' {
+			$$.options = 0;
+			$$.envlist = $3.envlist;
 		} ;
 
 envlist:	/* empty */ {
@@ -195,6 +209,7 @@
 	{ "args", TARGS },
 	{ "nopass", TNOPASS },
 	{ "keepenv", TKEEPENV },
+	{ "setenv", TSETENV },
 };
 
 int