Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #243226

Re: doas 101 question

Show all headers | View raw

On 12/17/21 8:16 PM, Greg Wooledge wrote:

> On Fri, Dec 17, 2021 at 12:20:43PM -0800, David Newman wrote:
>> How to configure /etc/doas.conf so a non-root user gets root's PATH?
> 
> This works for me:
> 
> unicorn:~$ PATH=/usr/local/bin:/usr/bin:/bin
> unicorn:~$ cat /etc/doas.conf
> permit setenv { PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin } greg
> unicorn:~$ doas env | grep PATH
> doas (greg@unicorn) password:
> PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Thanks for this. I get similar results where doas shows root's PATH -- 
but I cannot execute a file called '/usr/local/sbin/s', which is owned 
by root:root and has 0750 permissions, unless I specify the full path:

dnewman@coppi:~$ echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
dnewman@coppi:~$ cat /etc/doas.conf
permit nopass setenv { 
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin } dnewman
dnewman@coppi:~$ doas env | grep PATH
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
dnewman@coppi:~$ doas s mailman3
doas: s: command not found
dnewman@coppi:~$ doas /usr/local/sbin/s mailman3
● mailman3.service - GNU Mailing List Manager
..

>> permit nopass setenv {
>> PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin } dnewman
>> as root
>> permit nopass keepenv root as root
>>
>> permit nopass setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } dnewman as root
>> permit nopass keepenv root as root
> 
> You've got two contradictory lines for "dnewman as root", with the latter
> having a setenv clause without PATH in it. 

Clarification: The examples in my previous email were two different 
two-line configurations. It wasn't a four-line doas.conf file.

The second two-line example was taken from an OpenBSD box where invoking 
doas allows execution without the full path. However, in that case I 
think it's because regular users already have /usr/local/sbin in their 
PATH, and so possibly unrelated to doas.

> I would imagine the latter
> wins out (because it occurs last), and therefore your PATH variable doesn't
> get set.
> 
> I don't know how repeated "dnewman as root" lines would be handled if only
> one of them had a setenv clause.  You could experiment and find out.  It
> would be easier just to get rid of the second line.

Good idea. Per the example above it's just one line now, similar to yours.

dn


> 

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

doas 101 question David Newman <dnewman@networktest.com> - 2021-12-17 21:40 +0100
  Re: doas 101 question Greg Wooledge <greg@wooledge.org> - 2021-12-18 05:20 +0100
    Re: doas 101 question David Newman <dnewman@networktest.com> - 2021-12-18 06:30 +0100
      Re: doas 101 question Tim Woodall <debianuser@woodall.me.uk> - 2021-12-18 08:00 +0100
      Re: doas 101 question Greg Wooledge <greg@wooledge.org> - 2021-12-18 16:10 +0100
        Re: doas 101 question David Robert Newman <david@davidrobertnewman.com> - 2021-12-25 06:00 +0100
          Re: doas 101 question Greg Wooledge <greg@wooledge.org> - 2021-12-25 15:00 +0100

csiph-web