I think we can relax the path restriction if there's no restriction on
command.
Index: doas.c
===================================================================
RCS file: /cvs/src/usr.bin/doas/doas.c,v
retrieving revision 1.39
diff -u -p -r1.39 doas.c
--- doas.c 27 Aug 2015 16:31:02 -0000 1.39
+++ doas.c 31 Aug 2015 19:03:27 -0000
@@ -433,8 +433,10 @@ main(int argc, char **argv, char **envp)
syslog(LOG_AUTHPRIV | LOG_INFO, "%s ran command %s as %s from %s",
myname, cmdline, pw->pw_name, cwd);
- if (setenv("PATH", safepath, 1) == -1)
- err(1, "failed to set PATH '%s'", safepath);
+ if (rule->cmd) {
+ if (setenv("PATH", safepath, 1) == -1)
+ err(1, "failed to set PATH '%s'", safepath);
+ }
execvpe(cmd, argv, envp);
if (errno == ENOENT)
errx(1, "%s: command not found", cmd);
Index: doas.conf.5
===================================================================
RCS file: /cvs/src/usr.bin/doas/doas.conf.5,v
retrieving revision 1.14
diff -u -p -r1.14 doas.conf.5
--- doas.conf.5 30 Jul 2015 14:02:04 -0000 1.14
+++ doas.conf.5 31 Aug 2015 19:05:58 -0000
@@ -73,6 +73,9 @@ The default is all users.
The command the user is allowed or denied to run.
The default is all commands.
Be advised that it's best to specify absolute paths.
+If a cmd is specified, only a restricted
+.Ev PATH
+will be searched.
.It Ic args ...
Arguments to command.
If specified, the command arguments provided by the user
