Doas on Guix System

General
1

The doas program is packaged on guix, but is there a way to completely remove sudo in preference of doas? On nixos one can simply programs.sudo.enable = false, but it seems a bit more involved on guix.

The only place I’ve found so far through a cursory glance over the guix repository is that sudo is only installed by the %base-packages/hurd variable, so could I modify that list to achieve my goal, or are there other places in guix where sudo is expected?

2

You may need to do

sudo guix system reconfigure
3

After a few hours of troubleshooting, I found the solution.

First, in order to get doas registered & configured properly, I had to create a custom service.

(define (config->files config)
  `(("/etc/doas.conf" ,(plain-file
                        "doas.conf"
                        (string-append "permit setenv {PATH=/usr/local/bin"
                                       ":/usr/local/sbin:/usr/bin:/usr/sbin} :wheel\n")))))

(define doas-service-type
  (service-type
   (name 'doas)
   (extensions
    (list
     (service-extension privileged-program-service-type
                        (lambda _ (list (file-like->setuid-program (file-append opendoas "/bin/doas")))))
     (service-extension profile-service-type
                        (lambda _ (list opendoas)))
     (service-extension special-files-service-type
                        config->files)))
   (description "A portable fork of the OpenBSD doas command.")
   (default-value '())))

It’s pretty hacky right now, but I’m thinking about cleaning it up, adding some actual configuration, and submitting a PR to the guix repo to add this.

Secondly, in order to remove sudo, you have to delete the entry from your privileged programs list.

(operating-system
  ;; some fields omitted
  (privileged-programs
   (delete (file-like->setuid-program (file-append sudo "/bin/sudo"))
           (delete (file-like->setuid-program (file-append sudo "/bin/sudoedit"))
                   %default-privileged-programs)))

This technically doesn’t remove sudo from your system profile, since there’s a line in the guix code adding it to %base-packages, but it does prevent sudo from actually working. If you want to go the extra mile you can remove sudo entirely by using the value returned by (delq sudo %base-packages) instead of just %base-packages

1 Like