Re: doas failsafe

2015-07-22 Thread lists
Figured out one can use an alias if the name of the command is difficult to type to somebody, and the author of the software is the one deciding how is the utility called. I have to think more instead of posting. I don't think we need the wrapper, but a config-check mode like pfctl has could be

Re: doas failsafe

2015-07-21 Thread lists
so, why not type su rather than doas? I will not type doas. Do you?

Re: doas failsafe

2015-07-21 Thread Chris Bennett
On Tue, Jul 21, 2015 at 05:42:54PM +0300, li...@wrant.com wrote: doas is extremely foul to type, compared to sudo or su stop inventing reasons not to make it right first time I don't know why you are sending so many foul messages to this list. I have gotten to the point of not wanting to

Re: doas failsafe

2015-07-21 Thread Karel Gardas
On Tue, Jul 21, 2015 at 5:30 PM, li...@wrant.com wrote: so, why not type su rather than doas? I will not type doas. Do you? If doas supplies kind of sudo functionality than I would rather use it instead of su and being root all the time. So yes, I will.

Re: doas failsafe

2015-07-21 Thread Kent R. Spillner
Your diff doesn't apply here, can you resend?

Re: doas failsafe

2015-07-21 Thread lists
Your diff doesn't apply here, can you resend? You can kiss anybody's ass. Are you traditionally ridiculing your origin or the general state of software? Idiot. Quit the crapping and do some real thinking and work actually.

Re: doas failsafe

2015-07-21 Thread Manuel Giraud
tekk t...@parlementum.net writes: I've never used a fully qualified path with doas and it works just fine. (doas mount, doas pkg_add, doas mg.) Do you mean in the config file or something? Requiring you to specify a full path on filtered commands or whatever? This may just be a recent change

Re: doas failsafe

2015-07-21 Thread Theo de Raadt
Ability to define alias in the doas config file might be nice. Just like ssh with the ssh_config file. I have always wanted a .lsrc file, which would allow me to override the special options for ls, as well. That's kind of what you are talking about, right? No, I think you are serious. And

Re: doas failsafe

2015-07-21 Thread ludovic coues
2015-07-21 10:56 GMT+02:00 Theo de Raadt dera...@cvs.openbsd.org: Ability to define alias in the doas config file might be nice. Just like ssh with the ssh_config file. I have always wanted a .lsrc file, which would allow me to override the special options for ls, as well. That's kind of

Re: doas failsafe

2015-07-21 Thread Theo de Raadt
Less code running with setuid root, the better. That is the entire point.

Re: doas failsafe

2015-07-21 Thread tekk
On Mon, Jul 20, 2015 at 11:58:34PM -0700, Manuel Giraud wrote: Ted Unangst t...@tedunangst.com writes: Manuel Giraud wrote: Hi, I've just shot myself in the foot after /etc/doas.conf tweaking. This patch adds a failsafe permit :wheel rule in case of syntax error. Is this safe

Re: doas failsafe

2015-07-21 Thread Manuel Giraud
Ted Unangst t...@tedunangst.com writes: Manuel Giraud wrote: Hi, I've just shot myself in the foot after /etc/doas.conf tweaking. This patch adds a failsafe permit :wheel rule in case of syntax error. Is this safe enough? Should it be done elsewhere (with some kind of visudo)? I think

Re: doas failsafe

2015-07-21 Thread ludovic coues
2015-07-21 8:58 GMT+02:00 Manuel Giraud man...@ledu-giraud.fr: Ted Unangst t...@tedunangst.com writes: Manuel Giraud wrote: Hi, I've just shot myself in the foot after /etc/doas.conf tweaking. This patch adds a failsafe permit :wheel rule in case of syntax error. Is this safe enough?

Re: doas failsafe

2015-07-21 Thread lists
doas is extremely foul to type, compared to sudo or su stop inventing reasons not to make it right first time once again, please ignore this if you are emotional

doas failsafe

2015-07-20 Thread Manuel Giraud
Hi, I've just shot myself in the foot after /etc/doas.conf tweaking. This patch adds a failsafe permit :wheel rule in case of syntax error. Is this safe enough? Should it be done elsewhere (with some kind of visudo)? Index: doas.c

Re: doas failsafe

2015-07-20 Thread Ted Unangst
Manuel Giraud wrote: Hi, I've just shot myself in the foot after /etc/doas.conf tweaking. This patch adds a failsafe permit :wheel rule in case of syntax error. Is this safe enough? Should it be done elsewhere (with some kind of visudo)? I think the failsafe is run su. Since it is possible

Re: doas failsafe

2015-07-20 Thread lists
I'm a lowly user but I ++ this, when testing out doas I did this a few times. allow : deny, permit : forbid Is that you, Flynn?

Re: doas failsafe

2015-07-20 Thread lists
I think the failsafe is run su. Visudo(8) style wrapper for doas(1) that would respect the editor preferences... is only a suggestion, no? We're 2015 here. Since it is possible to configure doas to even less than permit :wheel this would in some cases be a fail open. I'm not sure how much

Re: doas failsafe

2015-07-20 Thread Ted Unangst
li...@wrant.com wrote: I think the failsafe is run su. Visudo(8) style wrapper for doas(1) that would respect the editor preferences... is only a suggestion, no? We're 2015 here. and vipf after that? there are countless config files, even more dangerous than doas.conf, that you edit at your

Re: doas failsafe

2015-07-20 Thread lists
I think the failsafe is run su. Visudo(8) style wrapper for doas(1) that would respect the editor preferences... is only a suggestion, no? We're 2015 here. and vipf after that? there are countless config files, even more dangerous than doas.conf, that you edit at your own peril.

Re: doas failsafe

2015-07-20 Thread tekk
On Mon, Jul 20, 2015 at 04:36:45PM -0700, lists wrote: So why can't allow fit as opposite to deny? (normally silence means no change in security model, hopefully). I'm a lowly user but I ++ this, when testing out doas I did this a few times. allow : deny, permit : forbid

Re: doas failsafe

2015-07-20 Thread Stuart Henderson
On 2015/07/20 19:18, Ted Unangst wrote: li...@wrant.com wrote: I think the failsafe is run su. Visudo(8) style wrapper for doas(1) that would respect the editor preferences... is only a suggestion, no? We're 2015 here. and vipf after that? there are countless config files, even more