On Mon, 4 May 2026 at 11:44:55 +0900, Takashi Shimizu wrote:
Hi,
I have been using security/doas installed via pkgsrc, and noticed that
/usr/pkg/bin and /usr/pkg/sbin are not included in either GLOBAL_PATH
or SAFE_PATH, both defined in doas.h.
Looking at the source:
doas.h defines:
GLOBAL_PATH (used as the default PATH in the environment)
SAFE_PATH (used to override PATH when rule->cmd is specified)
Both currently contain /usr/local/bin and /usr/local/sbin, but not
${PREFIX}/bin or ${PREFIX}/sbin.
Since this is a pkgsrc package and pkgsrc installs everything under
${PREFIX} (typically /usr/pkg), having neither path in GLOBAL_PATH
nor SAFE_PATH makes doas effectively unable to find pkgsrc-installed
commands in many common configurations.
This does not appear to be an intentional security decision -- the
paths simply seem to have been carried over from the original
OpenBSD/Linux port without pkgsrc-specific adjustment. If there is
a security rationale for excluding ${PREFIX}/bin, I would appreciate
hearing it.
If this is considered a bug, the natural fix would be a patch to
doas.h using pkgsrc's @PREFIX@ substitution:
--- doas.h.orig
+++ doas.h
@@ -1,7 +1,7 @@
#ifndef GLOBAL_PATH
-#define GLOBAL_PATH
"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+#define GLOBAL_PATH
"@PREFIX@/sbin:@PREFIX@/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/
usr/bin:/sbin:/bin"
#endif
#ifndef SAFE_PATH
-#define SAFE_PATH
"/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
+#define SAFE_PATH
"@PREFIX@/sbin:@PREFIX@/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/u
sr/sbin:/bin:/sbin"
#endif
Using @PREFIX@ rather than a hardcoded /usr/pkg ensures the fix
works correctly regardless of the LOCALBASE setting.
I am happy to submit this as a formal patch if it is accepted.
Thanks,
Takashi Shimizu
Hi,
I've added the paths, the commit being:
https://mail-index.netbsd.org/pkgsrc-changes/2026/05/07/msg345668.html
You'll see I did it a bit differently, as there's already an override
made for this purpose in the make tooling, so probably best to keep
it together there. I also kept (my interpretation of) upstream's
intended ordering as-is (it varies between the two definitions).
Regards,
Dave