simplify makefile

[opendoas.git] / doas.conf.5

diff --git a/doas.conf.5 b/doas.conf.5
index 6273e726be843a06b69054183b292396d29513cb..461ef3f662295e69fbe649e8fc4de5225fd733f3 100644 (file)
--- a/doas.conf.5
+++ b/doas.conf.5
@@ -33,7 +33,7 @@ The rules have the following format:
 .Op Ar options
 .Ar identity
 .Op Ic as Ar target
-.Op Ic cmd Ar command Op Ic args ...
+.Op Ic cmd Ar command Op Ic args No ...
 .Ed
 .Pp
 Rules consist of the following parts:
@@ -45,28 +45,28 @@ Options are:
 .Bl -tag -width keepenv
 .It Ic nopass
 The user is not required to enter a password.
+.It Ic nolog
+Do not log successful command execution to
+.Xr syslogd 8 .
+.It Ic persist
+After the user successfully authenticates, do not ask for a password
+again for some time.
 .It Ic keepenv
-The user's environment is maintained.
-The default is to reset the environment, except for the variables
-.Ev DISPLAY ,
-.Ev HOME ,
-.Ev LOGNAME ,
-.Ev MAIL ,
-.Ev PATH ,
-.Ev TERM ,
-.Ev USER
-and
-.Ev USERNAME .
-.It Ic setenv { Oo Ar variable ... Oc Ic Oo Ar variable=value ... Oc Ic }
-In addition to the variables mentioned above, keep the space-separated
-specified variables.
-Variables may also be removed with a leading - or set using the latter syntax.
+Environment variables other than those listed in
+.Xr doas 1
+are retained when creating the environment for the new process.
+.It Ic setenv { Oo Ar variable ... Oc Oo Ar variable=value ... Oc Ic }
+Keep or set the space-separated specified variables.
+Variables may also be removed with a leading
+.Sq -
+or set using the latter syntax.
 If the first character of
 .Ar value
 is a
 .Ql $
 then the value to be set is taken from the existing environment
-variable of the same name.
+variable of the indicated name.
+This option is processed after the default environment has been created.
 .El
 .It Ar identity
 The username to match.
@@ -83,7 +83,7 @@ Be advised that it is best to specify absolute paths.
 If a relative path is specified, only a restricted
 .Ev PATH
 will be searched.
-.It Ic args ...
+.It Ic args Op Ar argument ...
 Arguments to command.
 The command arguments provided by the user need to match those specified.
 The keyword
@@ -113,32 +113,37 @@ as a result, comments may not be extended over multiple lines.
 If quotes or backslashes are used in a word,
 it isn't considered a keyword.
 .El
+.Sh FILES
+.Bl -tag -width /etc/examples/doas.conf -compact
+.It Pa /etc/doas.conf
+.Xr doas 1
+configuration file.
+.It Pa /etc/examples/doas.conf
+Example configuration file.
+.El
 .Sh EXAMPLES
-The following example permits users in group wsrc to build ports,
-wheel to execute commands as any user while keeping the environment
+The following example permits user aja to install packages
+from a preferred mirror;
+group wheel to execute commands as any user while keeping the environment
 variables
 .Ev PS1
 and
 .Ev SSH_AUTH_SOCK
 and
 unsetting
-.Ev ENV ,
-permits tedu to run procmap as root without a password,
-and additionally permits root to run unrestricted commands as itself.
+.Ev ENV ;
+permits tedu to run procmap as root without a password;
+and additionally permits root to run unrestricted commands as itself
+while retaining the original PATH.
 .Bd -literal -offset indent
-# Non-exhaustive list of variables needed to
-# build release(8) and ports(7)
-permit nopass setenv { \e
-        FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK \e
-        DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF \e
-        MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR \e
-        PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY \e
-        SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc
-permit nopass setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel
+permit persist setenv { PKG_CACHE PKG_PATH } aja cmd pkg_add
+permit setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel
 permit nopass tedu as root cmd /usr/sbin/procmap
+permit nopass keepenv setenv { PATH } root as root
 .Ed
 .Sh SEE ALSO
-.Xr doas 1
+.Xr doas 1 ,
+.Xr syslogd 8
 .Sh HISTORY
 The
 .Nm