How to allow a user to run specific actions as root?
reddit / BSD

----------------------------------------------------------------------
TriWest2018 · 2018-11-26 15:28

My regular user account can't reboot or shutdown the computer unless I
login as root. Is there a way to allow my user account to run specific
actions as root?

----------------------------------------------------------------------
moviuro · 2018-11-26 15:33

sudo (and sudoers(5)) or doas (and doas.conf(5)).

----------------------------------------------------------------------
phessler · 2018-11-26 15:34

sudo or doas, depending on which one is installed for your system.

Check the man pages, they usually have examples of what you can do.

----------------------------------------------------------------------
tangomikey · 2018-11-26 21:30

https://www.tedunangst.com/flak/post/doas-mastery

----------------------------------------------------------------------
CounterfeitCactus · 2018-11-26 23:20

Additionally, sudo has several examples right in the default config,
and there's typically one which you can uncomment and/or tweak a
little to do what you need.

----------------------------------------------------------------------
TriWest2018 · 2018-11-27 15:51

Thank you! This is what I was looking for.

----------------------------------------------------------------------
vermaden · 2018-11-28 09:47

From the builtin tools, the ``setuid`` and ``setgid`` from
``chmod(1)`` command.

           4000    (the setuid bit).  Executable files with this bit
set will run with effective uid set to
                   the uid of the file owner.  Directories with this
bit set will force all files and sub-
                   directories created in them to be owned by the
directory owner and not by the uid of the
                   creating process, if the underlying file system
supports this feature: see chmod(2) and the
                   suiddir option to mount(8).

           2000    (the setgid bit).  Executable files with this bit
set will run with effective gid set to
                   the gid of the file owner.

From the Ports/packages you have:

- doas

- sudo

I use ``doas(1)`` and ``sudo(8)`` in my ``network.sh`` script for
network management on FreeBSD:

https://vermaden.wordpress.com/2018/03/24/freebsd-network-management-
with-network-sh-script/

I also added ``doas`` and ``sudo`` arguments to display what exact
configuration parameters needed with permissions for each tool type:

**doas(1)**

    % network.sh doas
      # pw groupmod network -m YOURUSERNAME
      # cat /usr/local/etc/doas.conf
      permit nopass :network as root cmd /etc/rc.d/netif args
onerestart
      permit nopass :network as root cmd dhclient
      permit nopass :network as root cmd ifconfig
      permit nopass :network as root cmd killall args -9 dhclient
      permit nopass :network as root cmd killall args -9 ppp
      permit nopass :network as root cmd killall args -9
wpa_supplicant
      permit nopass :network as root cmd ppp
      permit nopass :network as root cmd tee args -a /etc/resolv.conf
      permit nopass :network as root cmd tee args /etc/resolv.conf
      permit nopass :network as root cmd umount
      permit nopass :network as root cmd wpa_supplicant

**sudo(8)**

    % network.sh sudo
      # pw groupmod network -m YOURUSERNAME
      # cat /usr/local/etc/sudoers
      %network ALL = NOPASSWD: /etc/rc.d/netif onerestart
      %network ALL = NOPASSWD: /sbin/dhclient *
      %network ALL = NOPASSWD: /sbin/ifconfig *
      %network ALL = NOPASSWD: /sbin/umount -f *
      %network ALL = NOPASSWD: /usr/bin/killall -9 dhclient
      %network ALL = NOPASSWD: /usr/bin/killall -9 ppp
      %network ALL = NOPASSWD: /usr/bin/killall -9 wpa_supplicant
      %network ALL = NOPASSWD: /usr/bin/tee -a /etc/resolv.conf
      %network ALL = NOPASSWD: /usr/bin/tee /etc/resolv.conf
      %network ALL = NOPASSWD: /usr/sbin/ppp *
      %network ALL = NOPASSWD: /usr/sbin/wpa_supplicant *

As You see in the comments user in ``network`` group can execute (and
use ``network.sh`` sctipt) all these commands and execute them as
``root`` user.

I also added in comments what permissions are needed for each command
in that ``network.sh`` script so you may also find that useful:

https://github.com/vermaden/scripts/blob/master/network.sh

Example snippet below:

    #DOAS# permit nopass :network as root cmd killall args -9
wpa_supplicant
    #SUDO# %network ALL = NOPASSWD: /usr/bin/killall -9 wpa_supplicant
    ${CMD} killall -9 wpa_supplicant 1> /dev/null 2> /dev/null
    echo ${CMD} killall -9 wpa_supplicant