1*881f6c5fSkn.\" $OpenBSD: doas.1,v 1.26 2022/12/22 19:53:22 kn Exp $ 27bfbda14Stedu.\" 37bfbda14Stedu.\"Copyright (c) 2015 Ted Unangst <tedu@openbsd.org> 47bfbda14Stedu.\" 57bfbda14Stedu.\"Permission to use, copy, modify, and distribute this software for any 67bfbda14Stedu.\"purpose with or without fee is hereby granted, provided that the above 77bfbda14Stedu.\"copyright notice and this permission notice appear in all copies. 87bfbda14Stedu.\" 97bfbda14Stedu.\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 107bfbda14Stedu.\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 117bfbda14Stedu.\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 127bfbda14Stedu.\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 137bfbda14Stedu.\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 147bfbda14Stedu.\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 157bfbda14Stedu.\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16*881f6c5fSkn.Dd $Mdocdate: December 22 2022 $ 177bfbda14Stedu.Dt DOAS 1 187bfbda14Stedu.Os 197bfbda14Stedu.Sh NAME 207bfbda14Stedu.Nm doas 217bfbda14Stedu.Nd execute commands as another user 227bfbda14Stedu.Sh SYNOPSIS 237bfbda14Stedu.Nm doas 240a39d05fStedu.Op Fl Lns 25a9ed2e03Ssthen.Op Fl a Ar style 26a8aeaa96Sjmc.Op Fl C Ar config 277bfbda14Stedu.Op Fl u Ar user 2899ff196dSschwarze.Ar command 29*881f6c5fSkn.Op Ar arg ... 307bfbda14Stedu.Sh DESCRIPTION 317bfbda14SteduThe 327bfbda14Stedu.Nm 337bfbda14Steduutility executes the given command as another user. 34588a95a3SzhukThe 35588a95a3Szhuk.Ar command 36588a95a3Szhukargument is mandatory unless 37aa569d08Stedu.Fl C , 38aa569d08Stedu.Fl L , 39588a95a3Szhukor 40588a95a3Szhuk.Fl s 41588a95a3Szhukis specified. 427bfbda14Stedu.Pp 43ac1ba4baSteduThe user will be required to authenticate by entering their password, 44ac1ba4baSteduunless configured otherwise. 45ac1ba4baStedu.Pp 469ca0417eSteduBy default, a new environment is created. 47d5a45c8aSteduThe variables 48d5a45c8aStedu.Ev HOME , 49d5a45c8aStedu.Ev LOGNAME , 50d5a45c8aStedu.Ev PATH , 51d5a45c8aStedu.Ev SHELL , 52d5a45c8aSteduand 53d5a45c8aStedu.Ev USER 541267e02cSschwarzeand the 551267e02cSschwarze.Xr umask 2 56d5a45c8aSteduare set to values appropriate for the target user. 579ca0417eStedu.Ev DOAS_USER 589ca0417eSteduis set to the name of the user executing 599ca0417eStedu.Nm . 60d5a45c8aSteduThe variables 61d5a45c8aStedu.Ev DISPLAY 62d5a45c8aSteduand 63d5a45c8aStedu.Ev TERM 64d5a45c8aSteduare inherited from the current environment. 65d5a45c8aSteduThis behavior may be modified by the config file. 66d5a45c8aSteduThe working directory is not changed. 67d5a45c8aStedu.Pp 687bfbda14SteduThe options are as follows: 697bfbda14Stedu.Bl -tag -width tenletters 70a9ed2e03Ssthen.It Fl a Ar style 71a1b562edSteduUse the specified authentication style when validating the user, 72a9ed2e03Ssthenas allowed by 73a9ed2e03Ssthen.Pa /etc/login.conf . 74a1b562edSteduA list of doas-specific authentication methods may be configured by adding an 75a9ed2e03Ssthen.Sq auth-doas 76a9ed2e03Ssthenentry in 77a1b562edStedu.Xr login.conf 5 . 78d5db240dStedu.It Fl C Ar config 79d5db240dSteduParse and check the configuration file 80d5db240dStedu.Ar config , 81d5db240dSteduthen exit. 82588a95a3SzhukIf 83588a95a3Szhuk.Ar command 84588a95a3Szhukis supplied, 85588a95a3Szhuk.Nm 86588a95a3Szhukwill also perform command matching. 87588a95a3SzhukIn the latter case 88588a95a3Szhukeither 89588a95a3Szhuk.Sq permit , 90588a95a3Szhuk.Sq permit nopass 91588a95a3Szhukor 92588a95a3Szhuk.Sq deny 93588a95a3Szhukwill be printed on standard output, depending on command 94588a95a3Szhukmatching results. 95a1b562edSteduNo command is executed. 960a39d05fStedu.It Fl L 974d7faafbSmartijnClear any persisted authentications from previous invocations, 9859e8430eSteduthen immediately exit. 9959e8430eSteduNo command is executed. 10017356784Sespie.It Fl n 10144b4717fSmartijnNon interactive mode, fail if the matching rule doesn't have the 10244b4717fSmartijn.Ic nopass 10344b4717fSmartijnoption. 1048e3a9410Snicm.It Fl s 1058e3a9410SnicmExecute the shell from 1068e3a9410Snicm.Ev SHELL 1078e3a9410Snicmor 1088e3a9410Snicm.Pa /etc/passwd . 1097bfbda14Stedu.It Fl u Ar user 1107bfbda14SteduExecute the command as 1117bfbda14Stedu.Ar user . 1127bfbda14SteduThe default is root. 1137bfbda14Stedu.El 1147bfbda14Stedu.Sh EXIT STATUS 1157bfbda14Stedu.Ex -std doas 116affd3ed5SteduIt may fail for one of the following reasons: 1177bfbda14Stedu.Pp 1187bfbda14Stedu.Bl -bullet -compact 1197bfbda14Stedu.It 120f81d9810SespieThe config file 121f81d9810Sespie.Pa /etc/doas.conf 122f81d9810Sespiecould not be parsed. 1237bfbda14Stedu.It 12425b571a3SteduThe user attempted to run a command which is not permitted. 1257bfbda14Stedu.It 12625b571a3SteduThe password was incorrect. 127cb7cef4cSzhuk.It 1287769b1a5SteduThe specified command was not found or is not executable. 1297bfbda14Stedu.El 13025b571a3Stedu.Sh SEE ALSO 131e39b9049Sjmc.Xr su 1 , 13225b571a3Stedu.Xr doas.conf 5 1337bfbda14Stedu.Sh HISTORY 1347bfbda14SteduThe 1357bfbda14Stedu.Nm 1367bfbda14Steducommand first appeared in 1377bfbda14Stedu.Ox 5.8 . 1387bfbda14Stedu.Sh AUTHORS 1397bfbda14Stedu.An Ted Unangst Aq Mt tedu@openbsd.org 140