Date: Mon, 18 Apr 2022 04:40:33 +0200
From: Wolf <wolf@wolfsden.cz>
To: ~alpine/users@lists.alpinelinux.org
Subject: Help me understand doas.conf
Message-ID: <YlzPobImpOvbm01m@ws>
Mail-Followup-To: ~alpine/users@lists.alpinelinux.org
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="4T76WqH6I7dvgxQ5"
Content-Disposition: inline


--4T76WqH6I7dvgxQ5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

I'm trying to configure doas to allow running one shell script without
requiring password. I've read the manual page and (I think) understood
it, however I still cannot wrap my head around the behaviour.

When I have this in my wheel.conf, everything works fine:

	permit persist :wheel
	permit nopass :wheel cmd /usr/local/bin/dock-network

However, once I switch the lines around like this:

	permit nopass :wheel cmd /usr/local/bin/dock-network
	permit persist :wheel

It does not work anymore:

	$ doas -n /usr/local/bin/dock-network
	doas: Authentication required

And I just do not understand why the order should matter. As for why I
even bother, I want to have the nopass in separate file in /etc/doas.d,
but I was not able to get it to work at all if it was in two separate
files.

Actually, now that I think about it, all my attempts with multiple files
matched the alphabetical order from the second (not working) case. But
for these two rules order just should not matter, no?

Thank you in advance for any advice regarding this.

W.


--=20
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

--4T76WqH6I7dvgxQ5
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEt4NJs4wUfTYpiGikL7/ufbZ/wakFAmJcz6EACgkQL7/ufbZ/
waldjg/+N+1/0ESHqBXFaVMSDxZtdFSD1dHNhVw/gsOC+pKXZL1Vz6oVfRTc4oG3
6w2MDHe2S4c3WFr0yK8qJ5xl+rkDHfBve7QIKR4GU2WNmT+q1IrlE8w8w8BPvO4R
SUE2VvMyWgJA9zoqBJzFQP/eEjVEZKVbe5aacJwqZj5kRI7kKbUAEWOfdmYnMXXf
4nhAobP9M6su2FiuAxnIiUbb8jJMpuh0L3ZAHQJMKKxaHW3SyeHRuiOOw78I9Wt3
Z6tadTp8FAoX0qs9gmxDY770YLX7V6Pq6QZzGMqoWnErShGmfwK63q1OYJzmIoP0
pSITsaW315vUTBs22rwByhdD1LQ0tdb/UTQD1SYv8tF011PHAIXybfLgcG/5k5Cv
AFMZPuJ3KS8V1SzKTdbqNXzsQw08kwM596rahsTb37x6k9l7RikPozuzVGoajoms
MD3jvjtuPJ43nGodYsSv9IjGLVk2A4osaRSYw8zE2sM6VQbugveQmno8KHIoErxc
EvpkUae0UqwkhKJ1l+sG+9t6N2MVJ/51Od+P4B1yh5poULkkXvu4Q0o3p3n5yMnn
jWeiqZmWcxWilBdEORS1gRsCyHElB20PCx+VZUTP8dgo/jHWAzmRqreIav6vd9LP
es25InqMfWfOp87YpjOpU1YiOtii8Ii09zMfCwMqUKJ8ZmCy/V4=
=36mB
-----END PGP SIGNATURE-----

--4T76WqH6I7dvgxQ5--