This is the FreeBSD port of the OpenBSD "doas" command. The doas program
allows a regular user to run commands as another user (usually root). The
doas command is a simplified (hopefully more secure) version of the "sudo"
command and offers an easier to read/modify configuration.
security/doas: Update 6.3p13 => 6.4
Changelog:
- Fix some typos in the documentation.
- Cause doasedit to better handle shell variables and find the best
text editor for altering files.
Improve port:
- Move BINMODE=4755 to plist: "@(,,4755) bin/doas" - BINMODE is applied
universally (to all programs and scripts). This means helper scripts
like doasedit, which are meant to be run as a regular user, were also
installed as setuid. This is a potential security issue.
- Move plist to file.
- Add "@sample" for "etc/doas.conf.sample".
PR: 293628
Sponsored by: UNIS Labs
MFH: 2026Q2
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
security/doas: update to 6.3p13 and switch to new upsteam
The upstream repository has migrated from GitHub to CodeBerg. There
has also been a new update which fixes editing files with a leading
slash (/) character and enables building on illumos/OmniOS.
PR: 289344
Reported by: Jesse Smith <jsmith@resonatingmedia.com> (maintainer)
security/{open,}doas: add CONFLICTS to each other
They install files with the same names.
PR: 279598
Reported by: fluffy (via email)
Fixes: 2820df617d13 (new port: portable version of OpenBSD's doas)
security/doas: update to 6.3p12
6.3p11:
* Cleaned up error checking for temporary files, removed redundant check.
* Fixed status check for copy and editor launch.
6.3p12:
* Make sure doasedit can work when target file to edit has a leading slash
character. ie A full path name is used.
* Update doas.1 manual page to indicate problems with piping input
on Linux when processes are launched by doas.
Upstream release announcement:
https://github.com/slicer69/doas/releases/tag/6.3p11https://github.com/slicer69/doas/releases/tag/6.3p12
PR: 278897
MFH: 2024Q2
security/doas: update to 6.3p10
This is a minor upgrade which includes two fixes for the doasedit utility,
allowing it to work with files containing special characters and including
more error checking.
Upstream release announcement:
https://github.com/slicer69/doas/releases/tag/6.3p10
PR: 278683
MFH: 2024Q2
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/doas: Update to 6.1
* Update the pkg-message to give users that install/upgrade the port some
info about the changed behavior regarding the environment variables. [1]
* Make the configuration of target user's sanitized $PATH that is set at
compile time more flexible by enabling users to configure it via
_GLOBAL_PATH. [2]
* Also pet portlint/portclippy by placing USES to the top of the USES block
and remove the superfluous occurence of GH_PROJECT while I'm here.
Changelog:
* Most environment variables are no longer copied to the target user's
(Only the first 15 lines of the commit message are shown above )
security/doas: Update to 6.0p1
This update brings the security/doas port up to date with upstream.
This gives us the added benefit of restricted path searching. Which
means if the admin puts a relative path in the doas.conf file, doas
will limit the number of places where the executable can be found.
This prevents users from putting malicious executables with the same
name in their custom path.
PR: 222092
Submitted by: jsmith@resonatingmedia.com (maintainer)
MFH: 2017Q3
security/doas: Update to version 6.0p.
- Pull tarball from a GitHub release rather than a commit.
- Update license information. There is code under BSD2CLAUSE and code
under ISCL.
PR: 217176
Submitted by: jsmith@resonatingmedia.com (maintainer)
Approved by: mat, swills (mentor, implicit)
Differential Revision: https://reviews.freebsd.org/D9664
Update to 5.9p4, which fixes a bug where command output is not displayed
properly when the user authenticates with "nopass" specified in the
doas.conf configuration file.
PR: 210851
Submitted by: jsmith@resonatingmedia.com (maintainer)
security/doas: 5.9p1 -> 5.9p2
- fixed a bug where, when the user authenticates successfully as root,
only the user's effective user id (euid) becomes zero (0).
This leads to file permission errors when performing upgrades or
other file-oriented operations.
- introduced gmake as a dependency as it is needed to process upstream's
makefile.
PR: 210596
Submitted by: jsmith@resonatingmedia.com (maintainer)
New port: security/doas
The doas program allows users to run commands as another user (usually
root). The doas program was written by the OpenBSD team to provide a
lightweight, simplified (and more secure) alternative to the sudo command.
Original upstream (OpenBSD) source:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/doas/
FreeBSD version: https://github.com/slicer69/doas
NOTE: I added the two patch files to workaround issues mentioned in the PR
about hardcoding of /usr/local.
PR: 210473
Submitted by: jsmith@resonatingmedia.com
Modified by: jrm@ftfl.ca (see PR) and me (roberto)
