doas (“dedicated openbsd application subexecutor”) is a program to execute commands as another user. The

system administrator An IT administrator, system administrator, sysadmin, or admin is a person who is responsible for the upkeep, configuration, and reliable operation of computer systems, especially multi-user computers, such as Server (computing), servers. The ...

can configure it to give specified users privileges to execute specified commands. It is

free and open-source Free and open-source software (FOSS) is software available under a Software license, license that grants users the right to use, modify, and distribute the software modified or not to everyone free of charge. FOSS is an inclusive umbrella term ...

under the ISC license and available in

Unix Unix (, ; trademarked as UNIX) is a family of multitasking, multi-user computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...

and

Unix-like A Unix-like (sometimes referred to as UN*X, *nix or *NIX) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Uni ...

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

s. doas was developed by Ted Unangst for

OpenBSD OpenBSD is a security-focused operating system, security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by fork (software development), forking NetBSD ...

as a simpler and safer

sudo () is a shell (computing), shell command (computing), command on Unix-like operating systems that enables a user to run a program with the security privileges of another user, by default the superuser. It originally stood for "superuser do", a ...

replacement. Unangst himself had issues with the default ''sudo'' config, which was his motivation to develop doas. doas was released with OpenBSD 5.8 in October 2015 replacing sudo. However, OpenBSD still provides sudo as a package.

Configuration

Definition of privileges should be written in the configuration file, /etc/doas.conf. The syntax used in the configuration file is inspired by the packet filter configuration file.

Examples

Allow user1 to execute procmap as

root In vascular plants, the roots are the plant organ, organs of a plant that are modified to provide anchorage for the plant and take in water and nutrients into the plant body, which allows plants to grow taller and faster. They are most often bel ...

without password: permit nopass user1 as root cmd /usr/sbin/procmap Allow members of the wheel group to run any command as root: permit :wheel as root Simpler version (only works if default user is root, which it is after install): permit :wheel To allow members of wheel group to run any command (default as root) and remember that they entered the password: permit persist :wheel

Ports and availability

Jesse Smith’s

port A port is a maritime facility comprising one or more wharves or loading areas, where ships load and discharge cargo and passengers. Although usually situated on a sea coast or estuary, ports can also be found far inland, such as Hamburg, Manch ...

of doas is packaged for

DragonFlyBSD DragonFly BSD is a free and open-source Unix-like operating system forked from FreeBSD 4.8. Matthew Dillon, an Amiga developer in the late 1980s and early 1990s and FreeBSD developer between 1994 and 2003, began working on DragonFly BSD in Jun ...

FreeBSD FreeBSD is a free-software Unix-like operating system descended from the Berkeley Software Distribution (BSD). The first version was released in 1993 developed from 386BSD, one of the first fully functional and free Unix clones on affordable ...

, and

NetBSD NetBSD is a free and open-source Unix-like operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was fork (software development), forked. It continues to ...

. According to the author, it also works on

illumos Illumos (stylized as "illumos") is a partly free and open-source Unix operating system. It has been developed since 2010 and is based on OpenSolaris, after the discontinuation of that product by Oracle. It comprises a kernel, device driver ...

and

macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...

. OpenDoas, a

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

port, is packaged for

Debian Debian () is a free and open-source software, free and open source Linux distribution, developed by the Debian Project, which was established by Ian Murdock in August 1993. Debian is one of the oldest operating systems based on the Linux kerne ...

Alpine Alpine may refer to any mountainous region. It may also refer to: Places Europe * Alps, a European mountain range ** Alpine states, which overlap with the European range Australia * Alpine, New South Wales, a Northern Village * Alpine National P ...

Arch An arch is a curved vertical structure spanning an open space underneath it. Arches may support the load above them, or they may perform a purely decorative role. As a decorative element, the arch dates back to the 4th millennium BC, but stru ...

CRUX CRUX is a lightweight x86-64 Linux distribution targeted at experienced Linux users and delivered by a tar.gz-based package system with BSD-style initscripts. It is not based on any other Linux distribution. It also utilizes a ports system ...

Fedora A fedora () is a hat with a soft brim and indented crown.Kilgour, Ruth Edwards (1958). ''A Pageant of Hats Ancient and Modern''. R. M. McBride Company. It is typically creased lengthwise down the crown and "pinched" near the front on both sides ...

, Gentoo,

GNU Guix GNU Guix (; portmanteau of Guile and Nix) is a functional cross-platform package manager and a tool to instantiate and manage Unix-like operating systems, based on the Nix package manager. Configuration and package recipes are written in Guile ...

Hyperbola In mathematics, a hyperbola is a type of smooth function, smooth plane curve, curve lying in a plane, defined by its geometric properties or by equations for which it is the solution set. A hyperbola has two pieces, called connected component ( ...

Manjaro Manjaro ( ) is a free and open-source Linux distribution based on the Arch Linux operating system with a focus on user-friendliness, accessibility, and improved software testing and stability compared to its upstream sources. It uses a rolling ...

Parabola In mathematics, a parabola is a plane curve which is Reflection symmetry, mirror-symmetrical and is approximately U-shaped. It fits several superficially different Mathematics, mathematical descriptions, which can all be proved to define exactl ...

NixOS NixOS is a free and open-source Linux distribution based on the Nix package manager. NixOS uses an immutable design and an atomic update model. Its use of a declarative configuration system allows reproducibility and portability. NixOS is conf ...

Ubuntu Ubuntu ( ) is a Linux distribution based on Debian and composed primarily of free and open-source software. Developed by the British company Canonical (company), Canonical and a community of contributors under a Meritocracy, meritocratic gover ...

, and

Void Linux Void Linux is an independent Linux distribution that uses the X Binary Package System (XBPS) package manager, which was designed and implemented from scratch, and the runit init system. Excluding binary kernel blobs, a base install is composed e ...

. Starting with Alpine Linux v3.16 release, OpenDoas became the suggested replacement for sudo, which got its security maintenance time reduced within the distribution.

References

{{OpenBSD Computer security software Unix software

Configuration

Examples

Ports and availability

See also

References