Playing with mdo(1)

[elephant]

A bit overkill, but this works as a sudo-ish replacement.

Assuming (as root):

root@host: $ id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)

... then set this rule where xxxx is your ordinary user's ID.

root@host: $ sysctl security.mac.do.rules='id=xxxx>id=0,gid=0,+gid=0,gid=5,+gid=5'

Then as the ordinary user ...

ordinary@host: $ mdo -u root whoami
root

Apparently, 'root' is the default so you can omit the '-u' clause for a shorter syntax.

ordinary@host: $ mdo whoami
root

 

[elephant]

I have mixed feelings on this. It's smaller, simpler. But ... there's no logging to /var/log/auth.log.

 

[vyryls]

I wish security/doas was in base.

The config is as easy as

permit :wheel

or similar.