Replace sudo with doas

[Patrick]

This is also a good opportunity to harden all /etc/sudoers.d exceptions.

Plan:

1. harden all /etc/sudoers.d exceptions
2. keep the /etc/sudoers.d for now even should we decide to no longer install sudo by default (to make it easier to go back to sudo, should a blocker come up)
3. implement /etc/doas.conf configuration generator in security-misc
4. add the /etc/doas.conf.d snippets
5. maybe port to doas

---

You did an amazing analysis of Kicksecure, Whonix /etc/sudoers.d snippets!

Could you please also investigate the already existing /etc/sudoers.d exceptions shipped by other projects such as Qubes? Because these will also need to be considered before we can port to doas.

sudo ls -la /etc/sudoers.d

---

The configuration generator would need to be atomic. Generate a variable first, then write with 1 command in a atomic way using sponge.

Also the configuration generator should not overwrite a maybe already existing user generated configuration. One that lacks our auto generated comment.

@arraybolt3

kicksecure/sdwdate/etc/sudoers.d/sdwdate

• This one’s a problem. Whereas the previous files provide nopasswd exceptions to specific users and groups, this file allows anyone to run /usr/sbin/sdwdate-clock-jump as root. doas lacks the ability to express a universal exception such as this, you can only grant exceptions to specific users or groups. The only files that actually attempt to use sdwdate-clock-jump via sudo are:

No problem. Hardened just now in git.

@arraybolt3

kicksecure/security-misc/etc/sudoers.d/pkexec-security-misc

Deleted.

@arraybolt3

kicksecure/security-misc/etc/sudoers.d/xfce-security-misc

Deleted.

@arraybolt3

kicksecure/usability-misc/etc/sudoers.d/tunnel_unpriv

Not a blocker. All commented out by default. Not a priority. If a user urgently needs this and it’s not possible with doas, the user could install sudo.