Piecuu/pmaports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pmaports/main
History
Aster Boese 30e5479de2
main/postmarketos-base: switch from doas to sudo-rs 
The version of OpenBSD's doas packaged by Alpine had its last commit
21-02-2022. This in itself is not bad, but the issue is that in that time,
there have been many MRs and issues filed to the repo that see no action.
One major MR, that being a hardening patch against rowhammer attacks,
has layed stale since 03-03-2024. After Natanael Copa asked if the repo
was still maintained, the response was that it is low-priority.

As such switching to sudo-rs, despite its larger size and attack surface, makes
sense due to more users and thus more eyes on it performing analysis and fixing
security issues quicker. OpenBSD doas does not have this itself, and a low-usage
fork of it definitely does not. While there are snazzier, more modern
alternatives like run0, capsudo, or s6-sudo, none of these are in a state where
they can fully replace all the features that sudo provides.

sudo-rs was chosen over the original sudo due to a few factors. The first is
memory safety, as Rust generally solves that issue in the codebase, so a whole
class of possible vulns are eliminated. Second is that sudo-rs is already in
use by larger distributions like Canonical's Ubuntu, meaning that the user base
is already quite large, leading to similar amounts of eyes on the source code.
Third, sudo-rs has had support from the original authors of sudo, allowing the
project to avoid the pitfalls of the legacy C codebase. Finally, sudo-rs has
already had two fairly recent independent security audits, meaning that their
security posture is diligent enough to be trusted.

See https://github.com/trifectatechfoundation/sudo-rs/tree/main/docs/audit

In the future, any further switch in the privilege-escalation tool should keep
the sudo command, be it through a symlink, shim, or a binary itself. This is
maintained currently due to having installed doas-sudo-shim by default, but
more care should be taken in the future to not break user workflows.

Partially reverts 0f327af853

See https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/4144

Signed-off-by: Aster Boese <asterboese@mailbox.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/7967>
2026-03-18 17:36:30 +00:00
..
0xffff {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
abootimg {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
abuild-sign-noinclude */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
adsp-audio treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
boot-deploy main/boot-deploy: upgrade to 0.23.0 2026-02-11 14:55:16 +00:00
bootmac main/bootmac: upgrade to 0.7.1 2026-02-07 23:56:13 +00:00
bootrr main/bootrr: upgrade to git20240706 2026-03-12 19:17:32 +00:00
cros-keyboard-map main/cros-keyboard-map: update to 0_git20251218 2026-03-18 17:22:28 +00:00
deviceinfo-converter main/deviceinfo-converter: profile.d script fixes 2026-02-26 03:00:27 +00:00
devicepkg-dev main/devicepkg-dev: add comment about modules-extra-initfs 2026-02-04 15:29:18 +00:00
devicepkg-utils main/devicepkg-utils: remove cmdline_append from example deviceinfo 2026-01-27 12:33:05 -08:00
dint main/dint: upgrade to 0.1.1 2026-02-14 02:09:52 +00:00
dtbloader main/dtbloader: upgrade to 1.5.3 2026-02-14 18:05:17 +05:00
dtbtool {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
dtbtool-exynos {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
dtbtool-sprd */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
f0rmz */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
gcc4 {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
gcc6 {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
gesture */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
gnome-shell-theme-e-ink */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
hello-world */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
hello-world-rust */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
hello-world-wrapper */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
hexagonfs-firmware-loader {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
hisi-wlan */*: fix invalid maintainer comment 2026-01-15 11:15:21 +00:00
hwtest {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
iskey */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
ldpath {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
librem5-agps */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
lk2nd main/lk2nd: upgrade to 22.0 2026-02-27 16:39:27 +00:00
make-dynpart-mappings */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
mdss-fb-init-hack */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
mipi-dbi-cmd {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
mkbootimg-osm0sis {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
mobile-config-thunderbird */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
msm-fb-refresher treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
msm-firmware-loader {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
mtk-mkimage treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
ofonoctl {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
pbsplash */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
pinephone-callaudiod treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
postmarketos-android-recovery-installer */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-artwork */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-base main/postmarketos-base: switch from doas to sudo-rs 2026-03-18 17:36:30 +00:00
postmarketos-base-downstream main/postmarketos-base-downstream: enable msm-modem-downstream openrc service on post-install 2026-02-20 15:31:54 +01:00
postmarketos-base-eink */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-base-nofde main/postmarketos-base-nofde: set provides version 2025-11-30 15:50:26 +01:00
postmarketos-base-ui main/postmarketos-base-ui: add ModemManager config override 2026-02-01 13:17:40 -08:00
postmarketos-base-ui-cage */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-base-ui-gnome main/postmarketos-base-ui-gnome: remove fractional scaling override 2026-03-17 11:31:57 +00:00
postmarketos-base-ui-gnome-mobile main/postmarketos-ui-phosh: recommend phosh-tour 2026-03-08 20:54:00 +01:00
postmarketos-base-ui-plasma main/postmarketos-base-ui-plasma: remove kwayland-integration dependency 2026-01-28 20:23:52 +01:00
postmarketos-boot-hwtest {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
postmarketos-bootsplash */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-config-nftables */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-cros-common */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-demos */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-dev */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-initramfs main/postmarketos-initramfs: don't halt execution if IN_CI 2026-03-12 19:17:36 +00:00
postmarketos-install-recommends treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
postmarketos-installkernel */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-keys {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
postmarketos-mkinitfs main/postmarketos-mkinitfs: upgrade to 2.9.0 2026-02-11 14:55:16 +00:00
postmarketos-mkinitfs-hook-apx */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-mkinitfs-hook-ci main/postmarketos-mkinitfs-hook-ci: add myself as Co-Maintainer 2026-03-12 19:17:36 +00:00
postmarketos-mkinitfs-hook-debug-shell {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
postmarketos-mkinitfs-hook-kernel-panic treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
postmarketos-mkinitfs-hook-maximum-attention treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
postmarketos-mkinitfs-hook-netboot main/postmarketos-mkinitfs-hook-netboot: remove maintainer 2026-01-23 17:33:02 +01:00
postmarketos-mkinitfs-hook-verbose-initfs treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
postmarketos-qemu-common */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-release-upgrade main/postmarketos-release-upgrade: fix Ollie's email address 2026-01-15 11:05:38 +00:00
postmarketos-release-upgrade-notification main/postmarketos-release-upgrade-notification: new aport 2026-01-27 15:20:22 +00:00
postmarketos-test main/postmarketos-test: add myself as Co-Maintainer 2026-03-12 19:17:36 +00:00
postmarketos-tweaks-setting-definitions */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-buffyboard */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-cage */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-ui-console */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-cosmic main/postmarketos-ui-cosmic: update pmos-base-ui pw audio name 2026-01-18 12:20:33 +00:00
postmarketos-ui-fbkeyboard main/postmarketos-ui-fbkeyboard: update maintainer 2026-03-03 22:11:33 +01:00
postmarketos-ui-gnome */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-gnome-mobile main/postmarketos-ui-phosh: recommend phosh-tour 2026-03-08 20:54:00 +01:00
postmarketos-ui-i3wm */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-kodi */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-lomiri main/postmarketos-ui-lomiri: various fixes and improvements 2026-02-26 03:00:27 +00:00
postmarketos-ui-lxqt */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-mate */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-mediaberry */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-moonlight */*: remove maintainership by inactive maintainers 2026-01-15 11:05:38 +00:00
postmarketos-ui-niri */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-openbox */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-os-installer */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-phosh main/postmarketos-ui-phosh: recommend phosh-tour 2026-03-08 20:54:00 +01:00
postmarketos-ui-plasma-bigscreen */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-plasma-desktop main/postmarketos-ui-plasma-desktop: only depend on plasma-login-manager for systemd 2026-03-03 19:16:53 +00:00
postmarketos-ui-plasma-mobile */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-retroarch */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-shelli */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-sway */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-sxmo-de-dwm */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-sxmo-de-i3 */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-sxmo-de-river */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-sxmo-de-sway */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-weston */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-ui-xfce4 */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-usb-moded main/postmarketos-usb-moded: add support for openrc 2026-01-15 16:52:13 +01:00
postmarketos-welcome */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
postmarketos-zram main/postmarketos-zram: override vm.min_free_kbytes if >= 1GB RAM 2026-03-12 15:55:24 +00:00
pxa-mkbootimg treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
qca-swiss-army-knife {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
reboot-mode */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
shelli */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
shutdown-clear-rtc-wakealarm treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
sm-sparse-image-tool */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
swclock-offset main/swclock-offset: upgrade to 0.3.0 2026-02-11 14:18:44 +00:00
tizen-mkdzimage treewide: add !check to options of packages without tests 2026-02-22 15:39:25 +00:00
ttyescape */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00
unixbench */*: update my name and email 2026-01-11 18:52:28 +01:00
unl0kr main/unl0kr: upgrade to 3.5.1 2026-03-06 19:51:31 +00:00
watchdog-kick {main,modem,device/community}: add missing maintainer lines 2026-01-03 18:36:33 +00:00
wcnss-wlan */*: fix invalid maintainer comment 2026-01-15 11:15:21 +00:00
woa-firmware-yoinker */*: move to maintainer= variables 2026-01-12 17:01:35 +01:00