doas

Run a command as root

$ doas [command]

$ doas -u [username] [command]

$ doas -s

$ doas -u [username] -s

$ doas -n [command]

$ doas -C [/etc/doas.conf] [command]

$ doas -L

doas [-nLs] [-a style] [-C config] [-u user] command [args]

doas (dedicated openbsd application subexecutor) is a minimal program for running commands as another user, typically root. It originated in OpenBSD as a simpler, more secure alternative to sudo with a significantly smaller codebase and attack surface.
Configuration is done through /etc/doas.conf with simple rules specifying who can run what. A basic rule might be: permit persist :wheel to allow members of the wheel group to execute commands as root with credential caching.
The configuration syntax is straightforward: each line is a rule with permit or deny, optional keywords like nopass (no password), persist (cache credentials), keepenv (preserve environment), and specifications for user, group, and allowed commands.
Unlike sudo's extensive feature set, doas focuses on the core use case of privilege escalation with minimal complexity. This makes it easier to audit and reduces potential security vulnerabilities. Many Linux distributions now package doas as a sudo alternative.

-n

Non-interactive mode; fail if password is required.

Clear any persisted authentication credentials.

Execute the shell from SHELL environment variable or from /etc/passwd.

Run the command as the specified user (default: root).

Use the specified authentication style.

Parse and check the specified config file and exit.

The command to execute with elevated privileges.

Configuration syntax differs from sudo; migration requires rewriting rules. Fewer features than sudo (no fine-grained command logging, no complex per-command options). Some software may expect sudo specifically. Must be configured before use (no default permissive configuration).

doas was created by Ted Unangst and introduced in OpenBSD 5.8 in 2015 as a replacement for sudo in the base system. The design goal was to provide necessary functionality with minimal code (around 1000 lines versus sudo's 100,000+). It has been ported to Linux and other systems, gaining popularity among security-conscious users.

doas.conf(5), sudo(8), su(1), sudoers(5)