From 30e5479de2f491406f9249d3ac024a35217c0dae Mon Sep 17 00:00:00 2001 From: Aster Boese Date: Sun, 8 Feb 2026 23:08:31 -0500 Subject: [PATCH] main/postmarketos-base: switch from doas to sudo-rs The version of OpenBSD's doas packaged by Alpine had its last commit 21-02-2022. This in itself is not bad, but the issue is that in that time, there have been many MRs and issues filed to the repo that see no action. One major MR, that being a hardening patch against rowhammer attacks, has layed stale since 03-03-2024. After Natanael Copa asked if the repo was still maintained, the response was that it is low-priority. As such switching to sudo-rs, despite its larger size and attack surface, makes sense due to more users and thus more eyes on it performing analysis and fixing security issues quicker. OpenBSD doas does not have this itself, and a low-usage fork of it definitely does not. While there are snazzier, more modern alternatives like run0, capsudo, or s6-sudo, none of these are in a state where they can fully replace all the features that sudo provides. sudo-rs was chosen over the original sudo due to a few factors. The first is memory safety, as Rust generally solves that issue in the codebase, so a whole class of possible vulns are eliminated. Second is that sudo-rs is already in use by larger distributions like Canonical's Ubuntu, meaning that the user base is already quite large, leading to similar amounts of eyes on the source code. Third, sudo-rs has had support from the original authors of sudo, allowing the project to avoid the pitfalls of the legacy C codebase. Finally, sudo-rs has already had two fairly recent independent security audits, meaning that their security posture is diligent enough to be trusted. See https://github.com/trifectatechfoundation/sudo-rs/tree/main/docs/audit In the future, any further switch in the privilege-escalation tool should keep the sudo command, be it through a symlink, shim, or a binary itself. This is maintained currently due to having installed doas-sudo-shim by default, but more care should be taken in the future to not break user workflows. Partially reverts 0f327af853f77df775ba438af98dd812d1ba4730 See https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/4144 Signed-off-by: Aster Boese Part-of: --- main/postmarketos-base/APKBUILD | 47 ++++++++++++++++------- main/postmarketos-base/rootfs-etc-sudoers | 3 ++ 2 files changed, 37 insertions(+), 13 deletions(-) diff --git a/main/postmarketos-base/APKBUILD b/main/postmarketos-base/APKBUILD index c095d32c4..e587b9bf7 100644 --- a/main/postmarketos-base/APKBUILD +++ b/main/postmarketos-base/APKBUILD @@ -1,7 +1,7 @@ # Co-Maintainer: Achill Gilgenast maintainer="Clayton Craft " pkgname=postmarketos-base -pkgver=53 +pkgver=54 pkgrel=0 pkgdesc="Meta package for minimal postmarketOS base" url="https://postmarketos.org" @@ -27,14 +27,12 @@ depends=" umount util-linux-login " -_pmb_recommends=" - doas - doas-sudo-shim -" +_pmb_recommends="sudo-rs" install="$pkgname.post-install $pkgname.post-upgrade" triggers="$pkgname.trigger=/usr/share/deviceinfo" subpackages=" $pkgname-core + $pkgname-doas $pkgname-fwupd $pkgname-grub $pkgname-mesa @@ -42,17 +40,12 @@ subpackages=" $pkgname-nftables-openrc:nftables_openrc $pkgname-openrc $pkgname-ssh + $pkgname-sudo + $pkgname-sudo-rs:sudo_rs postmarketos-release:release postmarketos-baselayout:baselayout " options="!check" - -replaces=" - sudo - sudo-ldap - " -replaces_priority=100 # leave plenty for alpine - # Every postmarketos installation with pmbootstrap <= 3.3.2 has # alpine-base in /etc/apk/world. But for multiple reasons, we do not # want to depend on it. So have a versioned provides that conflicts @@ -156,6 +149,13 @@ core() { ln -s usr/sbin "$subpkgdir"/sbin } +doas() { + pkgdesc="doas configuration" + install_if="$pkgname=$pkgver-r$pkgrel doas" + + amove etc/doas.d/10-postmarketos.conf +} + fwupd() { pkgdesc="fwupd configuration" install_if="$pkgname=$pkgver-r$pkgrel systemd-boot fwupd" @@ -200,6 +200,27 @@ ssh() { amove etc/ssh/sshd_config.d/50-postmarketos-ui-policy.conf } +sudo() { + pkgdesc="sudo configuration" + install_if="$pkgname=$pkgver-r$pkgrel sudo" + replaces="sudo" + replaces_priority=100 # leave plenty for alpine + + install -Dm644 "$pkgdir"/etc/sudoers \ + -t "$subpkgdir"/etc/ +} + +sudo_rs() { + pkgdesc="sudo-rs configuration" + install_if="$pkgname=$pkgver-r$pkgrel sudo-rs" + replaces="sudo-rs" + replaces_priority=100 # leave plenty for alpine + + amove etc/sudoers + # sudo-rs requires all listed directories in sudoers to exist at runtime + mkdir -p "$subpkgdir"/etc/sudoers.d +} + openrc() { provides="$pkgname-init" provider_priority=10 @@ -254,7 +275,7 @@ release() { } sha512sums=" -e529f5cef1f31481b577f99b8917704f2cfefb963d98bf40a14b017938e55a00134d2033f81d2cb0b8489c5e9b4a92fdc0a788013f1adb4cd46d9580c9988186 rootfs-etc-sudoers +dbdf6d22077234a9e51459d1bc7706faa4f7cb5af1509e86247497d430d31c53a5ad4f177fa39864e5eee6a446d0fd7f86fdec93ff0a9263543c502d4d070e29 rootfs-etc-sudoers 49cff0dbf37fc3c3ca30709be3bc4bbac9b2c05d1f88356922c6ab849e1fe893da7eca92b42a4095cfa00fe475470a711a93bfa60f1cedfde9c890a6dcc61de9 rootfs-etc-doas.d-10-postmarketos.conf 1d2975e7e2745020f88fac639021cc9a47b477fb0390c3e146a070d98faab32c3f1c7bd1121f45a26be97301ab65c736ae0a4905d28a7251919a1994895f9c8d rootfs-etc-ssh-sshd_config.d-50-postmarketos-ui-policy.conf e0d2d48b82a03239a4c0a00acaf83e00d397c23a8d7c71053d4e2a383357c22dcedef9e81b0e12a1d7514e1fdbe0bb3eb82613d18b29034a7ce5447f13c84a53 rootfs-etc-conf.d-swapfile diff --git a/main/postmarketos-base/rootfs-etc-sudoers b/main/postmarketos-base/rootfs-etc-sudoers index f05905fa3..8e97b7df7 100644 --- a/main/postmarketos-base/rootfs-etc-sudoers +++ b/main/postmarketos-base/rootfs-etc-sudoers @@ -14,3 +14,6 @@ root ALL=(ALL) ALL ## Read drop-in files from /etc/sudoers.d @includedir /etc/sudoers.d + +## Show asterisks when entering password +Defaults pwfeedback