Hacker News Reader

Comment by ggm | Hacker News Reader

is this actually going to wind up stopping Sudo bash or is this "if you use it right you don't need to" which is a euphemism for "yea but everyone does"

View on HN

Anecdotal, but I've been using the doas in Arch's repository since switching to it. So far, I haven't come across anything that requires sudo instead of doas.

There are actually 2 Arch doases, note, one in the AUR and one in core. One is OpenDOAS, the other Smith doas.

Doubt it. The one thing doas is missing (from my POV) is caching the authorization. Sudo will allow you to cache the authorization on every(?) platform, but doas will only allow this on OpenBSD. If you're running "sudo bash" to avoid reentering your password a million times, doas (likely) won't help.

However if you're running "sudo bash", you should probably consider setting the root shell appropriately and just use "sudo -l".

OpenDoas has opt-in persistence via the --with-timestamp build flag. And on NixOS, for example, it's built with this flag by default.

Thanks for providing NixOS commentary. I’d was leery something in Nix would break, so I never tried.

No problem. FWIW I use doas over sudo on all 3 of my Nix hosts and I've only ever had one issue - VeraCrypt has a hardcoded shell-out to sudo, so I can't use it.

The proper fix would be VeraCrypt implementing polkit, but I just use cryptsetup's implementation.

This is actually an interesting case. Openbsd implemented timing out the connection by adding it to the tty[1]. this sort of shenanigan would never fly on linux, "what! improve an unrelated established system, I don't think so." So for a long time doas on linux was not able to timeout a session. At some later point the timeout code was re-implemented on linux using a different mechanism[2].

If your linux doas does not timeout, try updating it?

1. http://man.openbsd.org/tty.4#TIOCSETVERAUTH

2. https://github.com/Duncaen/OpenDoas/blob/master/timestamp.c

Well my use case was DragonFly and FreeBSD where there is a version of doas available, but not opendoas.

> "sudo -l"

ITYM "sudo -i" -l lists the programs your user may run as root/the-specified-user

The main thing missing is sudoedit equivalent. That replaces doas vi which is a security whole

Reply on news.ycombinator.com