Technical Beauty Episode 34. doas: ~1,100 lines of C and yacc, default in OpenBSD 5.8 since October 2015, by Ted Unangst. No PAM, no LDAP, no plugin loader, no /etc/doas.d/ fragments, no Defaults block. One file, one grammar, one rule per line. The sudo CHANGELOG carries Baron Samedit, Pwfeedback, sudoedit arbitrary file write, host-option and chroot CVEs. The upstream OpenBSD doas, in the same period, has carried no comparable critical CVE. The CHANGELOGs are the empirical case.
No pages have linked to this URL yet.