From nobody Sat Mar 07 00:22:03 2026 X-Original-To: ports-bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fSP973fbjz6Tk2c for ; Sat, 07 Mar 2026 00:22:03 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fSP971vGJz447q for ; Sat, 07 Mar 2026 00:22:03 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1772842923; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZLVav7iA2K53ciQ2e+j29b1krfxNZqLfmBZGEgbHVwg=; b=UQE5ZlQlr/7+90rNmU1ChPMI77s9FYXSiN1TrSn7J+kEiiIkEKdYW5DOa7+4bOIbWww4qa kf5K9dn1ngb7L0TsKGbJ9syJP6LawOn0zzDsM0mue3wJW64UiwjyZVq3U9hioF5orwOXz2 jK2Y0FI7fYGCelQ4Givc7EDem0efBKO9/z/qEk6qiIThJNihRkzRuZmm6IbwzXytmlZpUn hg9GsBY/CLBaJ4WRFbeuxCUL+nyEGEL0N0CQALsU5A/5ojiVSbzsr0O3Z5c4oNjnYX/jyQ i4AZVSu+U0p8yR5CXOTvGt2XsN/5/M32tDMt3WDaWDNtKiVNMQ9pZ2rKA1bYDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1772842923; a=rsa-sha256; cv=none; b=prykOQ0tVrRydMuYw/D1/t+WLZk0ERTNHIGV5yMGfpoqfRZ3wmfmreE0BAhnr8jGNu2ua9 CW5+ZxvQuM9g49esE3Ib7MYmUJI515kYRoL/HzYqq107deGG+KkuIzLcPdDEGVhEy9OL48 qGj5aNIqdkMLitToHfX7EtJklDiR/JFAsla+lyHgg26PPsM0hIkZmhsXOkceT/Y0kdf0Wl GwWkyckxxqSV/lPU0heA/KyGFNCldyTX2yFfZelN/6kSnvz+qj/Vi3Hhj+K+X9akJEHQJC mOF3fIW0tc1CX9bHs/bXJTpGL6V/kGKXaKGDgBPqAaNPCD1WFJGQN9JUQccLng== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1772842923; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZLVav7iA2K53ciQ2e+j29b1krfxNZqLfmBZGEgbHVwg=; b=FWx8P1vKLncmLMbIfaV6zUTNj16AzvBUYjAOqIaKo4uQ7sI/k/qwErh2UmtTwgcOoj942W GMMOKSjAx8zPWiV0Q+fUEheiG/tUWRNXiMMCDBUFXjPu9M9qMugBLQqf1j+J+stn0WTEY8 n90XqTGtFRz39Dybv1ovwck7PNEdOnXv5lAAm0yWzde5pUravAeO6EUur/8dpLz1niUoAf TZGyigQpuyu+xtb1YumOGnTV9jueYAgXLej1KSKqpVA9sB+UmysqS4Aof32b8mAg4/vu7A HKsAFAr87y+uJj3cmxr0PlDb2NXAzVxVszvTjl+MonJi3DTNIj35ZfCck8Q3tg== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4fSP971VVYzm31 for ; Sat, 07 Mar 2026 00:22:03 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 6270M3Dc069003 for ; Sat, 7 Mar 2026 00:22:03 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 6270M30w069002 for ports-bugs@FreeBSD.org; Sat, 7 Mar 2026 00:22:03 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 293628] security/doas: Update port to version 6.4 - bug fix permissions Date: Sat, 07 Mar 2026 00:22:03 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: jsmith@resonatingmedia.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Ports bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-ports-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-ports-bugs@freebsd.org Sender: owner-freebsd-ports-bugs@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D293628 Bug ID: 293628 Summary: security/doas: Update port to version 6.4 - bug fix permissions Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: jsmith@resonatingmedia.com Created attachment 268590 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D268590&action= =3Dedit Update port to match upstream, fix permissions This patch for the security/doas port introduces two changes: 1. It updates the port to match upstream's latest version. This fixes some typos in the documentation and causes doasedit to better handle shell varia= bles and find the best text editor for altering files. 2. Originally the FreeBSD port used BINMODE to setuid the doas executable program. This worked okay when there was just one executable file in the po= rt, but BINMODE is applied universally (to all programs and scripts). This means helper scripts like doasedit, which are meant to be run as a regular user, = were also installed as setuid. This is a potential security issue. The attached patch uses default/regular permissions for all files _except_ = the doas program, which is set to mode 4755. There doesn't appear to be any "correct" way to handle this in the ports handbook, so the updated Makefile just sets the mode using the "install" program. --=20 You are receiving this mail because: You are the assignee for the bug.=