Replace sudo with doas

[Patrick]

@arraybolt3

/etc/sudoers.d/umask

• Trouble. This one changes umask settings for sudo commands in general. doas handles umask configuration entirely on its own and does not allow the end-user to configure it. Thus this cannot be translated. Depending on what doas’s umask settings are and how vital this configuration is, this may or may not be a blocker.

dpkg -S /etc/sudoers.d/umask

qubes-core-agent: /etc/sudoers.d/umask

Will need to open a ticket at Qubes.

Related:

Restrict umask to 027 except for sudo/root broken

Change the default umask to 006

change default umask

The umask is what sets the default permissions for newly created files. Whonix has this set to 022 which gives read access to every user on the system for newly created files. 077 is recommended as it makes newly created files not readable by anyone other than the owner. You can set the umask with the umask command. To set it as 077 by default, add umask 077 to /etc/profile and/or shell configuration files e.g. /etc/bash.bashrc. It may be useful to add this to Whonix to prevent ordinary users …

@arraybolt3

Porting things to doas means that some of Qubes OS’s software will need to be ported to be doas-compatible also, which may or may not be something they’re interested in.

Will also need a ticket.

@arraybolt3

In the worst case, we’d end up having to maintain sudoers support for Qubes, and only providing doas support for non-Qubes. Maintaining both sounds like it could be difficult.

Yes.

@arraybolt3

Might be worth filing a feature request in Qubes OS?

Yes, please.